Overview

overview

10

Static

static

3

7ed62395ca...18.exe

windows7-x64

10

7ed62395ca...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ed62395cac1fd0ac7b392c471a19506_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240801-ctxwsswhrk

  • MD5

    7ed62395cac1fd0ac7b392c471a19506

  • SHA1

    a855b7ed4aad62335a03accd70d89f10b575f7ad

  • SHA256

    950f64922eedf7dffb34db1e2f388c34b913f9197f8cd75a4952048392e13651

  • SHA512

    a51518cbb0c8319b3baea4353c37c39e3b7b3b3f01ba5b152c69df0f1f659dacdc1d82d374a6f823bedf3f7ceed20337164c0d760ce7756a8bdf3706ca84d6eb

  • SSDEEP

    24576:LHvZTs+eR5Wm5ylzXx/APrj+YD9YYMkPktmhUlEcLb+bJuXrSlQ+9o:bBTs+ahyhXaTj+YpTPkYClnf+bJu7Cl

Score
10/10
ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      7ed62395cac1fd0ac7b392c471a19506_JaffaCakes118

    • Size

      1.1MB

    • MD5

      7ed62395cac1fd0ac7b392c471a19506

    • SHA1

      a855b7ed4aad62335a03accd70d89f10b575f7ad

    • SHA256

      950f64922eedf7dffb34db1e2f388c34b913f9197f8cd75a4952048392e13651

    • SHA512

      a51518cbb0c8319b3baea4353c37c39e3b7b3b3f01ba5b152c69df0f1f659dacdc1d82d374a6f823bedf3f7ceed20337164c0d760ce7756a8bdf3706ca84d6eb

    • SSDEEP

      24576:LHvZTs+eR5Wm5ylzXx/APrj+YD9YYMkPktmhUlEcLb+bJuXrSlQ+9o:bBTs+ahyhXaTj+YpTPkYClnf+bJu7Cl

    Score
    10/10
    ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks