Overview

overview

10

Static

static

7

8abd944bc9...18.exe

windows7-x64

10

8abd944bc9...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8abd944bc95f1405c78571316360e5a7_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240811-rx15ysxhlf

  • MD5

    8abd944bc95f1405c78571316360e5a7

  • SHA1

    39339afa8e146bb530a847ff0be2df05c89dc02c

  • SHA256

    e65530e5bd03f81a9b278cee98a55ade9062564fd905ea85c557595b5ae77423

  • SHA512

    e5a4bc3dcd4f3ba5aebf028586f57dd0a29ee6e14795e237a547378384bd4476efd7306a1b88d4cb4f9238e8821ac26e5cddcc3b5a6b559968562c9541121c4e

  • SSDEEP

    49152:hbl3ebR9Ov2Q754AAhAZN7HzcgQ8PJYCsCfk2:hdenOv2Q754AAM7Hz9QlCfk2

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealerthemida

Malware Config

Targets

    • Target

      8abd944bc95f1405c78571316360e5a7_JaffaCakes118

    • Size

      1.8MB

    • MD5

      8abd944bc95f1405c78571316360e5a7

    • SHA1

      39339afa8e146bb530a847ff0be2df05c89dc02c

    • SHA256

      e65530e5bd03f81a9b278cee98a55ade9062564fd905ea85c557595b5ae77423

    • SHA512

      e5a4bc3dcd4f3ba5aebf028586f57dd0a29ee6e14795e237a547378384bd4476efd7306a1b88d4cb4f9238e8821ac26e5cddcc3b5a6b559968562c9541121c4e

    • SSDEEP

      49152:hbl3ebR9Ov2Q754AAhAZN7HzcgQ8PJYCsCfk2:hdenOv2Q754AAM7Hz9QlCfk2

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealerthemida

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks