Extracted

• • Target
    82335d4eeb36490bdb86308628aa4d48_JaffaCakes118
  • Size 676KB
  • SHA256 a5479d518825e70a86607fa9ea141f446b97c83c963fe1fc508bc87930b47be5
  • MD5 82335d4eeb36490bdb86308628aa4d48
  • SHA1 ea6c3b339cc1f295057e967619cafe7c5d1f5e9f
  • SHA512 7957dcdcb2f4d2052449541ede615f17284e78c8552f66e3eaba407002baad969a55e1de809397f357ca8806d58d628f09de679e3e9e92b8876a9ca4adcdd843
  • SSDEEP 12288:13TdtLW5WIj1YSSdFxJhpvBSXyMzBUWb9lx/9AgHLo8OW+rB2:dDsj1dE5h5BcJ9nPx/igrp+M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypersistencespywarestealerardamaxsalitybackdoorevasionkeyloggerprivilege_escalationtrojanupx

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax main executable

  • Modifies WinLogon for persistence

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1behavioral2