Overview

overview

10

Static

static

3

604d424543...18.exe

windows7-x64

10

604d424543...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    604d424543bc2eb56442f007b79c3ce4_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240720-2tdwcs1bnr

  • MD5

    604d424543bc2eb56442f007b79c3ce4

  • SHA1

    ae8b2394ff498823163346968de336ecf51f76d6

  • SHA256

    c6a86f2c27b1250d7dbdabeedfa5edd5e6b3baf1d66955fbe08dec8821864103

  • SHA512

    2f01840ebb5094cc83e811f886438dbfcd689c526bed3727dab5525fa7c15eb77c20137e2b67212da2c7cae82e27d19f8c53d50e624cef443b9399a9a211255b

  • SSDEEP

    49152:eqxKXBJASciVHSLKi6YwkKrjjFETxNPV:eUKXX5chu91r1up

Score
10/10
ardamaxkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      604d424543bc2eb56442f007b79c3ce4_JaffaCakes118

    • Size

      1.8MB

    • MD5

      604d424543bc2eb56442f007b79c3ce4

    • SHA1

      ae8b2394ff498823163346968de336ecf51f76d6

    • SHA256

      c6a86f2c27b1250d7dbdabeedfa5edd5e6b3baf1d66955fbe08dec8821864103

    • SHA512

      2f01840ebb5094cc83e811f886438dbfcd689c526bed3727dab5525fa7c15eb77c20137e2b67212da2c7cae82e27d19f8c53d50e624cef443b9399a9a211255b

    • SSDEEP

      49152:eqxKXBJASciVHSLKi6YwkKrjjFETxNPV:eUKXX5chu91r1up

    Score
    10/10
    ardamaxkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks