Overview

overview

10

Static

static

3

a643d5b27e...18.exe

windows7-x64

10

a643d5b27e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a643d5b27e260ea4ff7c46f16dcd959b_JaffaCakes118

  • Size

    493KB

  • Sample

    240818-lj9maaxdpc

  • MD5

    a643d5b27e260ea4ff7c46f16dcd959b

  • SHA1

    ffb846de6a24440b2b3f67af0dee774ed7f3fc90

  • SHA256

    d7d08a4ee7b992ddb7bc025846d2b4eccb24bfe71023b6c14405af2a8e65196f

  • SHA512

    abc763d21d676d8affe9178e39824b2d0dd1013d815640fd5e7017efd22dbf76e291356f37c40fd86b45f08573fee544c143ff5f13a024d8df294b92fbf538c6

  • SSDEEP

    12288:vG739zeP9HAfZjpLIjZKiWlIKVBcUg4HmPO3RSRBg8xLUMudBS:439iP9HUZdsR5ccUfH7GrxLUMue

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      a643d5b27e260ea4ff7c46f16dcd959b_JaffaCakes118

    • Size

      493KB

    • MD5

      a643d5b27e260ea4ff7c46f16dcd959b

    • SHA1

      ffb846de6a24440b2b3f67af0dee774ed7f3fc90

    • SHA256

      d7d08a4ee7b992ddb7bc025846d2b4eccb24bfe71023b6c14405af2a8e65196f

    • SHA512

      abc763d21d676d8affe9178e39824b2d0dd1013d815640fd5e7017efd22dbf76e291356f37c40fd86b45f08573fee544c143ff5f13a024d8df294b92fbf538c6

    • SSDEEP

      12288:vG739zeP9HAfZjpLIjZKiWlIKVBcUg4HmPO3RSRBg8xLUMudBS:439iP9HUZdsR5ccUfH7GrxLUMue

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks