General

  • Target

    c2a2f2f334153755ee1c6d2cf79446e2_JaffaCakes118

  • Size

    682KB

  • Sample

    240826-khngzswfjr

  • MD5

    c2a2f2f334153755ee1c6d2cf79446e2

  • SHA1

    5b2796d23f6905ff99d9d86d409984bae4aca678

  • SHA256

    2327f28f1e27386b63fb5aa222cd7be4583c55ec6454a325934e003a20acce80

  • SHA512

    91d314969ccc084ee96132a5ce7b59b1f2d8686d97bf826232c6a33478146f154a41cc9d12265b7a66f88d365551d5c13a78fda8415504503110e34459c03c03

  • SSDEEP

    12288:1lFSYkn8S88r/n8S88rWAwpLYbbXsehUfKY3NmzDDxNp6aDAYzxE8VnGG4J+kQ0:M8oL8oCAwpLmT1kduZP6ae8ViJ+kQ0

Malware Config

Targets

    • Target

      c2a2f2f334153755ee1c6d2cf79446e2_JaffaCakes118

    • Size

      682KB

    • MD5

      c2a2f2f334153755ee1c6d2cf79446e2

    • SHA1

      5b2796d23f6905ff99d9d86d409984bae4aca678

    • SHA256

      2327f28f1e27386b63fb5aa222cd7be4583c55ec6454a325934e003a20acce80

    • SHA512

      91d314969ccc084ee96132a5ce7b59b1f2d8686d97bf826232c6a33478146f154a41cc9d12265b7a66f88d365551d5c13a78fda8415504503110e34459c03c03

    • SSDEEP

      12288:1lFSYkn8S88r/n8S88rWAwpLYbbXsehUfKY3NmzDDxNp6aDAYzxE8VnGG4J+kQ0:M8oL8oCAwpLmT1kduZP6ae8ViJ+kQ0

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.