Overview

overview

10

Static

static

3

dfc4076522...18.exe

windows7-x64

10

dfc4076522...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfc4076522186734ade1c2ba0ec32173_JaffaCakes118

  • Size

    518KB

  • Sample

    240914-jm3a9stepd

  • MD5

    dfc4076522186734ade1c2ba0ec32173

  • SHA1

    a1070c204de5ddd2e1a9cba8e469bd03b0bdb78e

  • SHA256

    bbdebf1bc2604098084adff16cc1765bca064e8788c0e048d80fe721fb5456bb

  • SHA512

    f66c8e543f3cad56de65db016abb1d83b013acc3b397fe5d205bfae1fa500d3883ca30ea2ba8b4ebe661f43bde39adc9af05acfa7f79e122aeeedcab476c1f52

  • SSDEEP

    12288:2IovIQgS6mIUP27DOhm3Os/CXL3+4rATWu/EAn8EGm:65gS7IU+nOFP+4skA8EH

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      dfc4076522186734ade1c2ba0ec32173_JaffaCakes118

    • Size

      518KB

    • MD5

      dfc4076522186734ade1c2ba0ec32173

    • SHA1

      a1070c204de5ddd2e1a9cba8e469bd03b0bdb78e

    • SHA256

      bbdebf1bc2604098084adff16cc1765bca064e8788c0e048d80fe721fb5456bb

    • SHA512

      f66c8e543f3cad56de65db016abb1d83b013acc3b397fe5d205bfae1fa500d3883ca30ea2ba8b4ebe661f43bde39adc9af05acfa7f79e122aeeedcab476c1f52

    • SSDEEP

      12288:2IovIQgS6mIUP27DOhm3Os/CXL3+4rATWu/EAn8EGm:65gS7IU+nOFP+4skA8EH

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks