Overview

overview

10

Static

static

7

4dc817425f...18.exe

windows7-x64

10

4dc817425f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4dc817425f7d45ae9ad07088cb94ade6_JaffaCakes118

  • Size

    4.7MB

  • Sample

    240716-lsy7xayhlc

  • MD5

    4dc817425f7d45ae9ad07088cb94ade6

  • SHA1

    5f4cd3542ad07666f26d1cc662abb568b13529c3

  • SHA256

    0b54f9dd8cef52f547a6d7a7b6ca4280ec62bc05ce9690b17ab7e71e99f9490a

  • SHA512

    e6e12f8f68b2717e343eefb666b969a7b2eaed64995aee22f8b57c2b83c35c4c6d8ee397b7ddd247f0b3e954b68c214f71d288bd1d4e3986961c17da6e390aec

  • SSDEEP

    98304:MKWvmu52gNpHVwztOGO8ajuvbjbz48CIShL/Qaeefw4oiDct729P:cmuYaw5I8ajuvLprShL/QyZoxt0

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealerupx

Malware Config

Targets

    • Target

      4dc817425f7d45ae9ad07088cb94ade6_JaffaCakes118

    • Size

      4.7MB

    • MD5

      4dc817425f7d45ae9ad07088cb94ade6

    • SHA1

      5f4cd3542ad07666f26d1cc662abb568b13529c3

    • SHA256

      0b54f9dd8cef52f547a6d7a7b6ca4280ec62bc05ce9690b17ab7e71e99f9490a

    • SHA512

      e6e12f8f68b2717e343eefb666b969a7b2eaed64995aee22f8b57c2b83c35c4c6d8ee397b7ddd247f0b3e954b68c214f71d288bd1d4e3986961c17da6e390aec

    • SSDEEP

      98304:MKWvmu52gNpHVwztOGO8ajuvbjbz48CIShL/Qaeefw4oiDct729P:cmuYaw5I8ajuvLprShL/QyZoxt0

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealerupx

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks