Overview

overview

10

Static

static

7

3deb1b80bd...18.exe

windows7-x64

10

3deb1b80bd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3deb1b80bd7b6803260b0f3497991e1e_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240712-ss613s1glg

  • MD5

    3deb1b80bd7b6803260b0f3497991e1e

  • SHA1

    9ed30034d9c78134feb2a445341d893f0bc4eb79

  • SHA256

    c2c16ebe19392e3651fe0abde3865eb7e6ffc62f4c81f13aa889e8ac565875e5

  • SHA512

    bbe266a2bf89585dceb8ec0c8942756a185aada94299a7e693e404cd7f7cd9a96eb4da0df68d39426c1ff1c3caa4d768afcf78a7c19cb41eaf3054394856192c

  • SSDEEP

    24576:u8gmUG1W4B5aKt2VWC8ijrjsCQafDv2QrRWxme7CkYjG0ngOtA:u8jZ1W43aKtiWC8mrjsCQaz2QrRWx7Wu

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealerupx

Malware Config

Targets

    • Target

      3deb1b80bd7b6803260b0f3497991e1e_JaffaCakes118

    • Size

      1.3MB

    • MD5

      3deb1b80bd7b6803260b0f3497991e1e

    • SHA1

      9ed30034d9c78134feb2a445341d893f0bc4eb79

    • SHA256

      c2c16ebe19392e3651fe0abde3865eb7e6ffc62f4c81f13aa889e8ac565875e5

    • SHA512

      bbe266a2bf89585dceb8ec0c8942756a185aada94299a7e693e404cd7f7cd9a96eb4da0df68d39426c1ff1c3caa4d768afcf78a7c19cb41eaf3054394856192c

    • SSDEEP

      24576:u8gmUG1W4B5aKt2VWC8ijrjsCQafDv2QrRWxme7CkYjG0ngOtA:u8jZ1W43aKtiWC8mrjsCQaz2QrRWx7Wu

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealerupx

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks