Overview

overview

10

Static

static

3

8c98a5b2c5...18.exe

windows7-x64

10

8c98a5b2c5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c98a5b2c5490cb06f507fc29183462f_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240812-ardn2awflp

  • MD5

    8c98a5b2c5490cb06f507fc29183462f

  • SHA1

    225edf9a81d20e25afc269e216f7d427b0d66d87

  • SHA256

    3601f3a392e0e283ca77fb45ab5b1c7dd3e07e42838c00475278b4a847e05617

  • SHA512

    e78168a493463fe238ccd7b63537d01fc7b1fe38cadadc79c27aaf000fbf2a8680a3513562f68eea8b18af6ad017a62e274394451967c121e194deca06eaaa57

  • SSDEEP

    24576:1k/ATqDUgwc1M+l4JlzICeTIa9ysxW/vPGY807j25HcTfd18UU5:qoTqDU5lUCe6KW/vO112u

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      8c98a5b2c5490cb06f507fc29183462f_JaffaCakes118

    • Size

      1.1MB

    • MD5

      8c98a5b2c5490cb06f507fc29183462f

    • SHA1

      225edf9a81d20e25afc269e216f7d427b0d66d87

    • SHA256

      3601f3a392e0e283ca77fb45ab5b1c7dd3e07e42838c00475278b4a847e05617

    • SHA512

      e78168a493463fe238ccd7b63537d01fc7b1fe38cadadc79c27aaf000fbf2a8680a3513562f68eea8b18af6ad017a62e274394451967c121e194deca06eaaa57

    • SSDEEP

      24576:1k/ATqDUgwc1M+l4JlzICeTIa9ysxW/vPGY807j25HcTfd18UU5:qoTqDU5lUCe6KW/vO112u

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks