Overview

overview

10

Static

static

3

682b26712c...18.exe

windows7-x64

10

682b26712c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    682b26712c5d442e59bbe6ded5d41fb0_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240723-s263faxdkj

  • MD5

    682b26712c5d442e59bbe6ded5d41fb0

  • SHA1

    75ada069ae7062852af3fa3ecf0b317cdf927053

  • SHA256

    60e75fde69c750b653a3801b39ee5829a7f2b44d81719a6d9af1346fcf5c4220

  • SHA512

    76a885a70e36243b0ea01a0121339f73a586da1a447fbb5ae3ba7270b195330cd8549e30fb736393579074a4101e5b0665c87c7bd0d2f63d53ef099e806aeb1a

  • SSDEEP

    24576:uHvZTPv+G2PkjaoSebcUu69+fTqeC+u4WX9FVrwW+BpXvtm9UOZWr:eBTPv+GckOoSew64melu4WtrV+BB0eaW

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      682b26712c5d442e59bbe6ded5d41fb0_JaffaCakes118

    • Size

      1.1MB

    • MD5

      682b26712c5d442e59bbe6ded5d41fb0

    • SHA1

      75ada069ae7062852af3fa3ecf0b317cdf927053

    • SHA256

      60e75fde69c750b653a3801b39ee5829a7f2b44d81719a6d9af1346fcf5c4220

    • SHA512

      76a885a70e36243b0ea01a0121339f73a586da1a447fbb5ae3ba7270b195330cd8549e30fb736393579074a4101e5b0665c87c7bd0d2f63d53ef099e806aeb1a

    • SSDEEP

      24576:uHvZTPv+G2PkjaoSebcUu69+fTqeC+u4WX9FVrwW+BpXvtm9UOZWr:eBTPv+GckOoSew64melu4WtrV+BB0eaW

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks