Overview

overview

10

Static

static

3

9f5923d425...18.exe

windows7-x64

10

9f5923d425...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f5923d425dac2dd7d0b17eea269b98c_JaffaCakes118

  • Size

    2.1MB

  • Sample

    240816-wdm67sxhmf

  • MD5

    9f5923d425dac2dd7d0b17eea269b98c

  • SHA1

    130a13a2f109b4888db93130cee2746c1cb10bd3

  • SHA256

    90c54934fc5887d22ac8fc84b3873acf00957a700ad83341af90536b31056975

  • SHA512

    91940d065d577d2aebb3a2fc7c2899f6741345353954616ea7d90bf08dbd7b017567655ba2a4f3f694e2578836ad3fd5a8e998bf9b3bab9747bda49ae9ac27f7

  • SSDEEP

    49152:50pTFz4RZI0s+VGDtLQhx455NcBl9qebx0eufRVRyg:5Gz4RZjPViLQC3N85x0ZZPyg

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      9f5923d425dac2dd7d0b17eea269b98c_JaffaCakes118

    • Size

      2.1MB

    • MD5

      9f5923d425dac2dd7d0b17eea269b98c

    • SHA1

      130a13a2f109b4888db93130cee2746c1cb10bd3

    • SHA256

      90c54934fc5887d22ac8fc84b3873acf00957a700ad83341af90536b31056975

    • SHA512

      91940d065d577d2aebb3a2fc7c2899f6741345353954616ea7d90bf08dbd7b017567655ba2a4f3f694e2578836ad3fd5a8e998bf9b3bab9747bda49ae9ac27f7

    • SSDEEP

      49152:50pTFz4RZI0s+VGDtLQhx455NcBl9qebx0eufRVRyg:5Gz4RZjPViLQC3N85x0ZZPyg

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks