Overview

overview

10

Static

static

3

617207e22b...18.exe

windows7-x64

10

617207e22b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    617207e22b773248ac162d3c731d92e2_JaffaCakes118

  • Size

    479KB

  • Sample

    240721-z7kvqaxenq

  • MD5

    617207e22b773248ac162d3c731d92e2

  • SHA1

    541b81ed9648b4fa95b56c78725523b147421f6d

  • SHA256

    16d81008d16cebf0bf85757b1e7789e3783584be97ddbbb3d7347323bffe91d7

  • SHA512

    f2d435e825ca9a7f57b5db594d52991847f9de6434b8c7c27beaaa298b5fa576ba2fcc6c9598929e1b7e70e00a94edb4acf9cad91754bb09e90a1e56a49c16d4

  • SSDEEP

    12288:3sltrW2kAjNf/Ww1J2HXD/rnf3Gf4iLKvu:c/MANXWw1GXDz+LGu

Score
10/10
ardamaxkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      617207e22b773248ac162d3c731d92e2_JaffaCakes118

    • Size

      479KB

    • MD5

      617207e22b773248ac162d3c731d92e2

    • SHA1

      541b81ed9648b4fa95b56c78725523b147421f6d

    • SHA256

      16d81008d16cebf0bf85757b1e7789e3783584be97ddbbb3d7347323bffe91d7

    • SHA512

      f2d435e825ca9a7f57b5db594d52991847f9de6434b8c7c27beaaa298b5fa576ba2fcc6c9598929e1b7e70e00a94edb4acf9cad91754bb09e90a1e56a49c16d4

    • SSDEEP

      12288:3sltrW2kAjNf/Ww1J2HXD/rnf3Gf4iLKvu:c/MANXWw1GXDz+LGu

    Score
    10/10
    ardamaxkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks