Overview

overview

10

Static

static

3

b5b1d76370...18.exe

windows7-x64

7

b5b1d76370...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5b1d763703c33438c101d5e1bf6d09c_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240822-a3t56azand

  • MD5

    b5b1d763703c33438c101d5e1bf6d09c

  • SHA1

    199e28b5e26a679abd193ffc215f9fbd5c8062aa

  • SHA256

    0a4ff2e067fe1644dfca1f3542bc44c86e05c67ec454b7a4775a8a15afa8e367

  • SHA512

    44a3290d6c935276da2c7285980a2027df76a7c9b78fe3afb049a6abdb39729f6bf259646698b46bf56485742fcbcbd0556b06c3085d092a272573282093c1ec

  • SSDEEP

    24576:UjxJRkKup3nSivnVM2EgFurReZLX23nHxNawI7JRgRRczuf1van6gG/9Kwfmwk:0ivV5iWLXwnzEyqzkExw

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      b5b1d763703c33438c101d5e1bf6d09c_JaffaCakes118

    • Size

      1.6MB

    • MD5

      b5b1d763703c33438c101d5e1bf6d09c

    • SHA1

      199e28b5e26a679abd193ffc215f9fbd5c8062aa

    • SHA256

      0a4ff2e067fe1644dfca1f3542bc44c86e05c67ec454b7a4775a8a15afa8e367

    • SHA512

      44a3290d6c935276da2c7285980a2027df76a7c9b78fe3afb049a6abdb39729f6bf259646698b46bf56485742fcbcbd0556b06c3085d092a272573282093c1ec

    • SSDEEP

      24576:UjxJRkKup3nSivnVM2EgFurReZLX23nHxNawI7JRgRRczuf1van6gG/9Kwfmwk:0ivV5iWLXwnzEyqzkExw

    Score
    10/10
    discoverypersistenceardamaxkeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks