Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

b36c4e0ef0...18.exe

windows7-x64

10

b36c4e0ef0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b36c4e0ef061080d7ed34c811658c920_JaffaCakes118

  • Size

    821KB

  • Sample

    240821-pgc23sxhlg

  • MD5

    b36c4e0ef061080d7ed34c811658c920

  • SHA1

    2e61485d3cfdf1ea1363e8dbbec0af198635af56

  • SHA256

    fcc3661896b923c4f46daacc2a7c1d85c2c8f1807da2f5a224d02f48ea527f76

  • SHA512

    d198c59fa3e979c1e9ebbc0809ce489040639ab82f00d53506bfb82d9a99ff0f2e4cfe936706092b0bbe31654622ce9cf11a38b899a1482da0269c0dd815c416

  • SSDEEP

    24576:eNeK5Koa8tVHoOXrmKAWunI8QW3OFWi+os:eNeKttVtv4HjGs

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      b36c4e0ef061080d7ed34c811658c920_JaffaCakes118

    • Size

      821KB

    • MD5

      b36c4e0ef061080d7ed34c811658c920

    • SHA1

      2e61485d3cfdf1ea1363e8dbbec0af198635af56

    • SHA256

      fcc3661896b923c4f46daacc2a7c1d85c2c8f1807da2f5a224d02f48ea527f76

    • SHA512

      d198c59fa3e979c1e9ebbc0809ce489040639ab82f00d53506bfb82d9a99ff0f2e4cfe936706092b0bbe31654622ce9cf11a38b899a1482da0269c0dd815c416

    • SSDEEP

      24576:eNeK5Koa8tVHoOXrmKAWunI8QW3OFWi+os:eNeKttVtv4HjGs

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks