Overview

overview

10

Static

static

3

c3ee2c0e5c...18.exe

windows7-x64

10

c3ee2c0e5c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3ee2c0e5cd4b5b1c942b5f3d608cf87_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240826-2gstrayene

  • MD5

    c3ee2c0e5cd4b5b1c942b5f3d608cf87

  • SHA1

    2aa933d64ba259c5206d56aeec9fcf633ad091f3

  • SHA256

    46b2746125cec77810128a52e5472bcd48e1cf7cde51f8ec61c0ec404886c7ad

  • SHA512

    ce8f85f5bcf7525c72a0addddcae92744366cbbfeb8e4338bd5bf0833b3d7026d77613e02ee38b083b4159ae8c8f6ab67749db40519a0c0a25cc483e95e86f24

  • SSDEEP

    24576:D64MVTibXz6rNnKx0LCzjqUoYW35lyyw2zc84XPhk2kpLi/kr4NqS8tq:D64MTQOr58boZ35lyw4pOs/sVt

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      c3ee2c0e5cd4b5b1c942b5f3d608cf87_JaffaCakes118

    • Size

      1.1MB

    • MD5

      c3ee2c0e5cd4b5b1c942b5f3d608cf87

    • SHA1

      2aa933d64ba259c5206d56aeec9fcf633ad091f3

    • SHA256

      46b2746125cec77810128a52e5472bcd48e1cf7cde51f8ec61c0ec404886c7ad

    • SHA512

      ce8f85f5bcf7525c72a0addddcae92744366cbbfeb8e4338bd5bf0833b3d7026d77613e02ee38b083b4159ae8c8f6ab67749db40519a0c0a25cc483e95e86f24

    • SSDEEP

      24576:D64MVTibXz6rNnKx0LCzjqUoYW35lyyw2zc84XPhk2kpLi/kr4NqS8tq:D64MTQOr58boZ35lyw4pOs/sVt

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks