Overview

overview

10

Static

static

3

87b63965c0...18.exe

windows7-x64

10

87b63965c0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87b63965c036f3af7d305ab45ec1827f_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240810-z585jasgkh

  • MD5

    87b63965c036f3af7d305ab45ec1827f

  • SHA1

    fe3b1b7e45f4dbb0e3ddf952e2f0743382342597

  • SHA256

    bb86957e31c8b905ccd6e1ec38a6ae8c231649165fe050d72a0899d052eca8b9

  • SHA512

    90edb3120f8a2fafdb497807d348b095f8a73279d4b59b6e18ebd2b7fffbb28785c6c916bc6df451ec48410c71bb3bf5e57033b8c36ade98be9422fa689f6696

  • SSDEEP

    24576:k64MVTIaSwOm2mD/r51AzAYs/eY0GBv7DAt+svO1mD3p82IfVQQ:k64MTrSTm2m7hveWvPNz2Iq

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      87b63965c036f3af7d305ab45ec1827f_JaffaCakes118

    • Size

      1.2MB

    • MD5

      87b63965c036f3af7d305ab45ec1827f

    • SHA1

      fe3b1b7e45f4dbb0e3ddf952e2f0743382342597

    • SHA256

      bb86957e31c8b905ccd6e1ec38a6ae8c231649165fe050d72a0899d052eca8b9

    • SHA512

      90edb3120f8a2fafdb497807d348b095f8a73279d4b59b6e18ebd2b7fffbb28785c6c916bc6df451ec48410c71bb3bf5e57033b8c36ade98be9422fa689f6696

    • SSDEEP

      24576:k64MVTIaSwOm2mD/r51AzAYs/eY0GBv7DAt+svO1mD3p82IfVQQ:k64MTrSTm2m7hveWvPNz2Iq

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks