Overview

overview

10

Static

static

3

9bf41ebde2...18.exe

windows7-x64

10

9bf41ebde2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9bf41ebde214b50f746a819b87fb0539_JaffaCakes118

  • Size

    481KB

  • Sample

    240815-2wlnzsvckj

  • MD5

    9bf41ebde214b50f746a819b87fb0539

  • SHA1

    1968a35b21292a8aab9bea1cfc52602b7cbb2686

  • SHA256

    5260bf6396474504cf0ce9490b724041a857dc79a7453aec38d7bf8c65b7391e

  • SHA512

    e8ae92a9b14f5b9cd8c861378f924e4dab1bc775a6b85976f16d1c8f4496ddc3a04d6e690db6b52cea7e6018bb0f9d1b1e582026b9a70e7f6322f0f91fc6a3e5

  • SSDEEP

    12288:nqnkbkXZ9w3+MOm6l73EshTv1qG24UFIeS4y5E7:qnkgX7w3+V7EshlPUFIy7

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      9bf41ebde214b50f746a819b87fb0539_JaffaCakes118

    • Size

      481KB

    • MD5

      9bf41ebde214b50f746a819b87fb0539

    • SHA1

      1968a35b21292a8aab9bea1cfc52602b7cbb2686

    • SHA256

      5260bf6396474504cf0ce9490b724041a857dc79a7453aec38d7bf8c65b7391e

    • SHA512

      e8ae92a9b14f5b9cd8c861378f924e4dab1bc775a6b85976f16d1c8f4496ddc3a04d6e690db6b52cea7e6018bb0f9d1b1e582026b9a70e7f6322f0f91fc6a3e5

    • SSDEEP

      12288:nqnkbkXZ9w3+MOm6l73EshTv1qG24UFIeS4y5E7:qnkgX7w3+V7EshlPUFIy7

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks