Overview

overview

10

Static

static

3

52ad7cd6c3...18.exe

windows7-x64

10

52ad7cd6c3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52ad7cd6c358b08f618b1f1fa8a08670_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240717-mz55gaxenk

  • MD5

    52ad7cd6c358b08f618b1f1fa8a08670

  • SHA1

    7e78f672565b3fbd8d0bcadb2fc80292f2accf89

  • SHA256

    13c1e76067eb75ae0525b7625373245e1f218e0252b282a9aa604b012b9c8044

  • SHA512

    047c6cc08651ddc08aea7e66670e602143388f593f1ee214ea62e6605b4a06dde75651e1c9bf19fd5b170380010ba8c4822495f01a8bd7df956b6a29551c75ff

  • SSDEEP

    24576:8U/pTKXofYFJQ0WOMhiMU70C2cO1WXOGU2S9VH0/hyaVe+5GVtONErmyFAev:1RTKn7QxRh4t2mK9efotOKyyFF

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      52ad7cd6c358b08f618b1f1fa8a08670_JaffaCakes118

    • Size

      1.4MB

    • MD5

      52ad7cd6c358b08f618b1f1fa8a08670

    • SHA1

      7e78f672565b3fbd8d0bcadb2fc80292f2accf89

    • SHA256

      13c1e76067eb75ae0525b7625373245e1f218e0252b282a9aa604b012b9c8044

    • SHA512

      047c6cc08651ddc08aea7e66670e602143388f593f1ee214ea62e6605b4a06dde75651e1c9bf19fd5b170380010ba8c4822495f01a8bd7df956b6a29551c75ff

    • SSDEEP

      24576:8U/pTKXofYFJQ0WOMhiMU70C2cO1WXOGU2S9VH0/hyaVe+5GVtONErmyFAev:1RTKn7QxRh4t2mK9efotOKyyFF

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks