Overview

overview

10

Static

static

3

776a720369...18.exe

windows7-x64

10

776a720369...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    776a720369b76f6cf9d47b882c3e8bcb_JaffaCakes118

  • Size

    3.1MB

  • Sample

    240727-jlwgbsvenp

  • MD5

    776a720369b76f6cf9d47b882c3e8bcb

  • SHA1

    e521c9f590bbf820f2c323d15224ca5ba198f7ef

  • SHA256

    49f73496415d89beeb3160501361141cb2fded8fee4e7f700964e3a029f3e576

  • SHA512

    c9a4acc7c881b1236818cf6cb3f5e24f60877e27a18847740e2a3d713b53d73cc38d7d446c0460e1154cfbe04ec122ad3f8ebaafd5a09a512caf280f3a20e530

  • SSDEEP

    49152:s8CEHrU13ImyLnZUbk73rjTlGxp+qSSwxJTVbLgLzo5B:s8dHrU13IrrZUbkPjoxeSc1VAM

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      776a720369b76f6cf9d47b882c3e8bcb_JaffaCakes118

    • Size

      3.1MB

    • MD5

      776a720369b76f6cf9d47b882c3e8bcb

    • SHA1

      e521c9f590bbf820f2c323d15224ca5ba198f7ef

    • SHA256

      49f73496415d89beeb3160501361141cb2fded8fee4e7f700964e3a029f3e576

    • SHA512

      c9a4acc7c881b1236818cf6cb3f5e24f60877e27a18847740e2a3d713b53d73cc38d7d446c0460e1154cfbe04ec122ad3f8ebaafd5a09a512caf280f3a20e530

    • SSDEEP

      49152:s8CEHrU13ImyLnZUbk73rjTlGxp+qSSwxJTVbLgLzo5B:s8dHrU13IrrZUbkPjoxeSc1VAM

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks