Overview

overview

10

Static

static

3

e0103649f3...18.exe

windows7-x64

10

e0103649f3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118

  • Size

    506KB

  • Sample

    240914-m9zens1flb

  • MD5

    e0103649f3bf097a9d4c22575b4225c3

  • SHA1

    7a77a2fb6d6e1eb98743f3906ef4e8c989696659

  • SHA256

    74bb28da128af06c7d0e9ce0fcc6242fa31d807760f28f31742c19520dc379bc

  • SHA512

    cd89081b3b72c8861bd6519d47149c2d6fc42faf907ca37fa0fbb528334bf6d7907d7dffa953e91be25467c741d207efe8cf9ab037b00bafabe1e873dc190012

  • SSDEEP

    12288:ohQtJ4pUKbi7eUjsrcuauQn6o/49z6BgF:oBNbi7xYZMzm

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118

    • Size

      506KB

    • MD5

      e0103649f3bf097a9d4c22575b4225c3

    • SHA1

      7a77a2fb6d6e1eb98743f3906ef4e8c989696659

    • SHA256

      74bb28da128af06c7d0e9ce0fcc6242fa31d807760f28f31742c19520dc379bc

    • SHA512

      cd89081b3b72c8861bd6519d47149c2d6fc42faf907ca37fa0fbb528334bf6d7907d7dffa953e91be25467c741d207efe8cf9ab037b00bafabe1e873dc190012

    • SSDEEP

      12288:ohQtJ4pUKbi7eUjsrcuauQn6o/49z6BgF:oBNbi7xYZMzm

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks