Overview

overview

10

Static

static

7

c7455a0df5...18.exe

windows7-x64

10

c7455a0df5...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7455a0df5b4a9ce440dfeeb5bb2569c_JaffaCakes118

  • Size

    3.4MB

  • Sample

    240828-vh137ayfjk

  • MD5

    c7455a0df5b4a9ce440dfeeb5bb2569c

  • SHA1

    45c9e68c69a782dc558b48275b83b767e797c1cf

  • SHA256

    118bd2c208c07459b9a2e4aac503caf199d75ac76eea05caca3a6cfde2ca3f81

  • SHA512

    f92b7fc29d4259edef641e0f5309cbf20a274ebb2cb142321f0df46c91423f530a66acb31457cddf24d87461f28e35c4922a28aeef7553cc735159f7bd524162

  • SSDEEP

    98304:lQ5r5QnumalSTNnfBJe63tzua39N7xdLKXKmT7EWlzZf/2WPhmIJ1xlo:laCntmMUvf/2WPhy

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealerthemida

Malware Config

Targets

    • Target

      c7455a0df5b4a9ce440dfeeb5bb2569c_JaffaCakes118

    • Size

      3.4MB

    • MD5

      c7455a0df5b4a9ce440dfeeb5bb2569c

    • SHA1

      45c9e68c69a782dc558b48275b83b767e797c1cf

    • SHA256

      118bd2c208c07459b9a2e4aac503caf199d75ac76eea05caca3a6cfde2ca3f81

    • SHA512

      f92b7fc29d4259edef641e0f5309cbf20a274ebb2cb142321f0df46c91423f530a66acb31457cddf24d87461f28e35c4922a28aeef7553cc735159f7bd524162

    • SSDEEP

      98304:lQ5r5QnumalSTNnfBJe63tzua39N7xdLKXKmT7EWlzZf/2WPhmIJ1xlo:laCntmMUvf/2WPhy

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealerthemida

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks