Overview

overview

10

Static

static

3

6d57f66ced...18.exe

windows7-x64

10

6d57f66ced...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d57f66cedb5869f3159e171565eda65_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240725-abnt3avgkq

  • MD5

    6d57f66cedb5869f3159e171565eda65

  • SHA1

    cab83ff76b7b1f646e1327d04cc3dce07ab9eb52

  • SHA256

    82261a50af6324158cfc405c08b56289d10272d01c7be888f7a6870807861bfb

  • SHA512

    2aef8c5ab27b6c167ea53fd23189a5bf9763ef27be24529e2c3a66cdbb62a30cd265f0ced132c38332c81dd35603970471708bc7c3a446995ce8a683e8fba9b0

  • SSDEEP

    24576:Ek/ATYRb5MnVTtXcDMU/dv+5L0lJzlUiUxKBQXfnI5NX:9oTYRtMnY/dplJNUp

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      6d57f66cedb5869f3159e171565eda65_JaffaCakes118

    • Size

      1.1MB

    • MD5

      6d57f66cedb5869f3159e171565eda65

    • SHA1

      cab83ff76b7b1f646e1327d04cc3dce07ab9eb52

    • SHA256

      82261a50af6324158cfc405c08b56289d10272d01c7be888f7a6870807861bfb

    • SHA512

      2aef8c5ab27b6c167ea53fd23189a5bf9763ef27be24529e2c3a66cdbb62a30cd265f0ced132c38332c81dd35603970471708bc7c3a446995ce8a683e8fba9b0

    • SSDEEP

      24576:Ek/ATYRb5MnVTtXcDMU/dv+5L0lJzlUiUxKBQXfnI5NX:9oTYRtMnY/dplJNUp

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks