General

  • Target

    640a6297760b7edd6b44ae57bf2903bb_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240722-vnpbksxgnh

  • MD5

    640a6297760b7edd6b44ae57bf2903bb

  • SHA1

    7cdfb067e875e65a6ebaa7c1df8f780ff0375501

  • SHA256

    f8a624c602a1e80c20f8ebe179f6f72c4df7957ea3adc3f0b925d78a9b00a035

  • SHA512

    cc4977351c0c4f7d156737a58cdc578ca865747053607f59de1520edca5e83fb6a392165a6439ff0253a28f4639422b5abd980cc5b6c7a7659cba8929d6ccae8

  • SSDEEP

    24576:D64MVTADWFtQq6PbuvzqO66IyW3nybU02SVdPUIYvwHZO6VvSAKXZ:D64MTOW7yu7qZEbhw3wHxqA

Malware Config

Targets

    • Target

      640a6297760b7edd6b44ae57bf2903bb_JaffaCakes118

    • Size

      1.1MB

    • MD5

      640a6297760b7edd6b44ae57bf2903bb

    • SHA1

      7cdfb067e875e65a6ebaa7c1df8f780ff0375501

    • SHA256

      f8a624c602a1e80c20f8ebe179f6f72c4df7957ea3adc3f0b925d78a9b00a035

    • SHA512

      cc4977351c0c4f7d156737a58cdc578ca865747053607f59de1520edca5e83fb6a392165a6439ff0253a28f4639422b5abd980cc5b6c7a7659cba8929d6ccae8

    • SSDEEP

      24576:D64MVTADWFtQq6PbuvzqO66IyW3nybU02SVdPUIYvwHZO6VvSAKXZ:D64MTOW7yu7qZEbhw3wHxqA

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks