Overview

overview

10

Static

static

3

390d998378...18.exe

windows7-x64

10

390d998378...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    390d998378d61d45cf8186dda81fda6d_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240711-pa9gpsyajd

  • MD5

    390d998378d61d45cf8186dda81fda6d

  • SHA1

    04b5001109a6e348b7a9fd4b53114beef94e9098

  • SHA256

    de5f83e416d00716b3837d527ed3ac798fc13b1032bcb271f302fa8b5aa0f12f

  • SHA512

    91f74a922f3d79ecbe2b7a64311e2d7c53148f4ce8328c18b7fd0b75f2de2861f6518406c95e1906bfa6e41c6b6adea92f9441ed4e5597cdf56da886f594eb15

  • SSDEEP

    24576:dZxTwVLKHKof5lDPRj7NOZVGVaIVfX4RdP4jOmVu0V27gTt:dXTwVOHK+nvu0VvfX4voLVu

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      390d998378d61d45cf8186dda81fda6d_JaffaCakes118

    • Size

      1.0MB

    • MD5

      390d998378d61d45cf8186dda81fda6d

    • SHA1

      04b5001109a6e348b7a9fd4b53114beef94e9098

    • SHA256

      de5f83e416d00716b3837d527ed3ac798fc13b1032bcb271f302fa8b5aa0f12f

    • SHA512

      91f74a922f3d79ecbe2b7a64311e2d7c53148f4ce8328c18b7fd0b75f2de2861f6518406c95e1906bfa6e41c6b6adea92f9441ed4e5597cdf56da886f594eb15

    • SSDEEP

      24576:dZxTwVLKHKof5lDPRj7NOZVGVaIVfX4RdP4jOmVu0V27gTt:dXTwVOHK+nvu0VvfX4voLVu

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks