Overview

overview

10

Static

static

3

a83acf4640...18.exe

windows7-x64

10

a83acf4640...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a83acf46401a254fa4c571fcdc606458_JaffaCakes118

  • Size

    1.7MB

  • Sample

    240818-z2pxgsxfrk

  • MD5

    a83acf46401a254fa4c571fcdc606458

  • SHA1

    6d24fe6e79c7118922d80889fe8182c413639042

  • SHA256

    17adfb6c866792d0dd22a0852c2d8190e24148f0678b7432a50ba03ebe4d0bff

  • SHA512

    2d8cebc384d076db9b46d4fd762f58a22018646bf5fafb04ac57374ca3f9ba3556b1f781dfe80b0fdb50053872934342929192f088523e36d2fee1f7e06549d3

  • SSDEEP

    24576:Tb1Xyoq4cvpuxFzywd2kQdd3j8Xua1f901:Tbf5FbC

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      a83acf46401a254fa4c571fcdc606458_JaffaCakes118

    • Size

      1.7MB

    • MD5

      a83acf46401a254fa4c571fcdc606458

    • SHA1

      6d24fe6e79c7118922d80889fe8182c413639042

    • SHA256

      17adfb6c866792d0dd22a0852c2d8190e24148f0678b7432a50ba03ebe4d0bff

    • SHA512

      2d8cebc384d076db9b46d4fd762f58a22018646bf5fafb04ac57374ca3f9ba3556b1f781dfe80b0fdb50053872934342929192f088523e36d2fee1f7e06549d3

    • SSDEEP

      24576:Tb1Xyoq4cvpuxFzywd2kQdd3j8Xua1f901:Tbf5FbC

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks