Overview

overview

10

Static

static

3

a7013195b8...18.exe

windows7-x64

10

a7013195b8...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a7013195b8247cbd78831f8401912d27_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240818-rrq3ss1akm

  • MD5

    a7013195b8247cbd78831f8401912d27

  • SHA1

    59d0c0b692c149d00e3ceb6c4cb877a67e1783af

  • SHA256

    9181d5fefe749fda5ef2f64e22b2b3ef0744b48dfefd2c14ac780c9c3f0b37a6

  • SHA512

    68a362b659c2fe23f0ed2785b2dbdda96b25ffa1c66fdfc7dd62782e856b2687dcce9faab93297b0fc37ddbc5e9481aea5f87f0954aa3ebc7e1ae570a4babdae

  • SSDEEP

    24576:RVgxh339yktt1Pa+YhV5+cdYGebiAM4sZoDHJrv7BfI1cZIV1J1SkriU2iuLngAY:Xg/9yYtVlYhPj4Hd9fVZUiKangAwbz

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      a7013195b8247cbd78831f8401912d27_JaffaCakes118

    • Size

      1.6MB

    • MD5

      a7013195b8247cbd78831f8401912d27

    • SHA1

      59d0c0b692c149d00e3ceb6c4cb877a67e1783af

    • SHA256

      9181d5fefe749fda5ef2f64e22b2b3ef0744b48dfefd2c14ac780c9c3f0b37a6

    • SHA512

      68a362b659c2fe23f0ed2785b2dbdda96b25ffa1c66fdfc7dd62782e856b2687dcce9faab93297b0fc37ddbc5e9481aea5f87f0954aa3ebc7e1ae570a4babdae

    • SSDEEP

      24576:RVgxh339yktt1Pa+YhV5+cdYGebiAM4sZoDHJrv7BfI1cZIV1J1SkriU2iuLngAY:Xg/9yYtVlYhPj4Hd9fVZUiKangAwbz

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks