Overview

overview

10

Static

static

3

8b55995113...18.exe

windows7-x64

10

8b55995113...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b559951131800c4eeea0b212367b583_JaffaCakes118

  • Size

    874KB

  • Sample

    240811-v9g5dszdnr

  • MD5

    8b559951131800c4eeea0b212367b583

  • SHA1

    1d7e6ba4c740330d87fb928c737497daa5d74f01

  • SHA256

    1e516bc4fad4430c8a410a5337c48e02f898b41c06d6285478dd6c9ac9ce7acc

  • SHA512

    cc51709928d967bfdea0c2c872efd810d54dbdf42e3aa38a97e77129877ed80478efe9219d4a000d05bef2660791ec8c598058549d691b15de11aa1783426008

  • SSDEEP

    24576:VmZsI79EdgW40VDHERST7G2zfri60RsAHVi5NHwB+D1n:oDAgW7kRSTysf2N6OoNQB+d

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      8b559951131800c4eeea0b212367b583_JaffaCakes118

    • Size

      874KB

    • MD5

      8b559951131800c4eeea0b212367b583

    • SHA1

      1d7e6ba4c740330d87fb928c737497daa5d74f01

    • SHA256

      1e516bc4fad4430c8a410a5337c48e02f898b41c06d6285478dd6c9ac9ce7acc

    • SHA512

      cc51709928d967bfdea0c2c872efd810d54dbdf42e3aa38a97e77129877ed80478efe9219d4a000d05bef2660791ec8c598058549d691b15de11aa1783426008

    • SSDEEP

      24576:VmZsI79EdgW40VDHERST7G2zfri60RsAHVi5NHwB+D1n:oDAgW7kRSTysf2N6OoNQB+d

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks