Overview

overview

10

Static

static

3

84fdc15fde...18.exe

windows7-x64

10

84fdc15fde...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    84fdc15fde13b7d8c42f4863c8d9e733_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240810-ggayqaxhjp

  • MD5

    84fdc15fde13b7d8c42f4863c8d9e733

  • SHA1

    43f269e486c7f17546457ec907e0ef3398981059

  • SHA256

    1bd54be0ddaa812a982ac985d9b36d082a3e440c7826439b768e60ebf5fa97af

  • SHA512

    58f2feaad3447a2c213b377cf602ce99e9ce7c0834d01ee77a14263b906a88af5aee78509b84b842b5a7cfac0745cb336a92fa38a40fe8ff05aaaeb1bd4158e0

  • SSDEEP

    24576:gZAhc+ETlHxeNbshkpJPQFoELe1C8DkgTW5HftMvDc9Fzx7dp3cf/F8j+HJ+:gZAq+ETZxoQKnPQFRLe1Jk4O/qLidx7V

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      84fdc15fde13b7d8c42f4863c8d9e733_JaffaCakes118

    • Size

      1.3MB

    • MD5

      84fdc15fde13b7d8c42f4863c8d9e733

    • SHA1

      43f269e486c7f17546457ec907e0ef3398981059

    • SHA256

      1bd54be0ddaa812a982ac985d9b36d082a3e440c7826439b768e60ebf5fa97af

    • SHA512

      58f2feaad3447a2c213b377cf602ce99e9ce7c0834d01ee77a14263b906a88af5aee78509b84b842b5a7cfac0745cb336a92fa38a40fe8ff05aaaeb1bd4158e0

    • SSDEEP

      24576:gZAhc+ETlHxeNbshkpJPQFoELe1C8DkgTW5HftMvDc9Fzx7dp3cf/F8j+HJ+:gZAq+ETZxoQKnPQFRLe1Jk4O/qLidx7V

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks