Overview

overview

10

Static

static

3

9e298d5970...18.exe

windows7-x64

10

9e298d5970...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e298d5970fd17c60c88d20047f60796_JaffaCakes118

  • Size

    327KB

  • Sample

    240816-njf13swclr

  • MD5

    9e298d5970fd17c60c88d20047f60796

  • SHA1

    c61620c2d26414182626a48564a7933157505338

  • SHA256

    3ce53a998b21f4264aaf9f8ca5e45abd385fdab7ae5ef6ba0c1214c83a637b69

  • SHA512

    6bbf9b2c28ff3fefcf5f57e87973bd40e75a3a0e0d92b2993ea7f6760fdf7a692c91b27158565eae552d7e743ae706c0e02fcb1c73811a9a6e524a2405c77ba8

  • SSDEEP

    6144:kmpyGv7sGZsdMp9V6eyzE+D53ZUEB3EICloAd1/3bIXf2pnewSO2L4g08vH:kckMf23ZUEOI0oAd1/b0fn3O2LvH

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      9e298d5970fd17c60c88d20047f60796_JaffaCakes118

    • Size

      327KB

    • MD5

      9e298d5970fd17c60c88d20047f60796

    • SHA1

      c61620c2d26414182626a48564a7933157505338

    • SHA256

      3ce53a998b21f4264aaf9f8ca5e45abd385fdab7ae5ef6ba0c1214c83a637b69

    • SHA512

      6bbf9b2c28ff3fefcf5f57e87973bd40e75a3a0e0d92b2993ea7f6760fdf7a692c91b27158565eae552d7e743ae706c0e02fcb1c73811a9a6e524a2405c77ba8

    • SSDEEP

      6144:kmpyGv7sGZsdMp9V6eyzE+D53ZUEB3EICloAd1/3bIXf2pnewSO2L4g08vH:kckMf23ZUEOI0oAd1/b0fn3O2LvH

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks