Overview

overview

10

Static

static

3

543b40c8d3...18.exe

windows7-x64

10

543b40c8d3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    543b40c8d3d8411af84ddbcea54c0c7e_JaffaCakes118

  • Size

    785KB

  • Sample

    240717-w11qtawfme

  • MD5

    543b40c8d3d8411af84ddbcea54c0c7e

  • SHA1

    168d7a2d8cf83e53e6066e26703c259c5a178268

  • SHA256

    8569758a01c527144fa3380aa48c5f6a2b591feabdd1ad330bdca1f09a1e12c4

  • SHA512

    93f1da4296277e50f817cf5d4a642ac6c6a11ee6a38e049d4250015b52e95c7f72964a2488d9846ff2d3fa2510bf3146ec3460b208a3cc66a03dea9fcd27a875

  • SSDEEP

    24576:HGpvKBBZ0plVORt6/y73WAvEBgHgiq9F++NBF4X:HGiBWT6twe3WAsk857k

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      543b40c8d3d8411af84ddbcea54c0c7e_JaffaCakes118

    • Size

      785KB

    • MD5

      543b40c8d3d8411af84ddbcea54c0c7e

    • SHA1

      168d7a2d8cf83e53e6066e26703c259c5a178268

    • SHA256

      8569758a01c527144fa3380aa48c5f6a2b591feabdd1ad330bdca1f09a1e12c4

    • SHA512

      93f1da4296277e50f817cf5d4a642ac6c6a11ee6a38e049d4250015b52e95c7f72964a2488d9846ff2d3fa2510bf3146ec3460b208a3cc66a03dea9fcd27a875

    • SSDEEP

      24576:HGpvKBBZ0plVORt6/y73WAvEBgHgiq9F++NBF4X:HGiBWT6twe3WAsk857k

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks