Overview

overview

10

Static

static

3

a54a4fd833...18.exe

windows7-x64

10

a54a4fd833...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a54a4fd833ecce0adc7068e76ff24858_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240818-egn48sxaln

  • MD5

    a54a4fd833ecce0adc7068e76ff24858

  • SHA1

    7349d70dce9523094d2841b01a66c8081a0644c6

  • SHA256

    836afd076b599f14e976ef06cebbcd7b72b35b4122c79cd89de33495d3ff63fb

  • SHA512

    bcaa6d11eab2bd1e0321653bf48cb64543d7ad02b079b316882e70e7bc26ab604d726d9c75116cb9ccd7e5c8e4c930126fb3bf3eab8c721a040ca3756423de35

  • SSDEEP

    24576:/sJ3+6PBzjkLuQ3M9BZ8/etvcoG7EQM8eqblNwTr1cX1gMpQ0ZQg3bXmXJa:/CXzj489BZ8GiHJeSYuyMpn3bXCc

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      a54a4fd833ecce0adc7068e76ff24858_JaffaCakes118

    • Size

      1.3MB

    • MD5

      a54a4fd833ecce0adc7068e76ff24858

    • SHA1

      7349d70dce9523094d2841b01a66c8081a0644c6

    • SHA256

      836afd076b599f14e976ef06cebbcd7b72b35b4122c79cd89de33495d3ff63fb

    • SHA512

      bcaa6d11eab2bd1e0321653bf48cb64543d7ad02b079b316882e70e7bc26ab604d726d9c75116cb9ccd7e5c8e4c930126fb3bf3eab8c721a040ca3756423de35

    • SSDEEP

      24576:/sJ3+6PBzjkLuQ3M9BZ8/etvcoG7EQM8eqblNwTr1cX1gMpQ0ZQg3bXmXJa:/CXzj489BZ8GiHJeSYuyMpn3bXCc

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks