Overview

overview

10

Static

static

3

ea94ca2f26...18.exe

windows7-x64

10

ea94ca2f26...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea94ca2f26b68c60d382793f6b138075_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240919-e2kyba1dqk

  • MD5

    ea94ca2f26b68c60d382793f6b138075

  • SHA1

    68253e94bb46f747e048c160369a95b57bfc3f65

  • SHA256

    eccf0fdd26a4943b1c5bff0b83492d3d605ce23c27a2524167bb76bb9eac8e25

  • SHA512

    3b86b3cd9eda5c443d2e0442ac119792c0edafcc3694c74493278ac01920f06bd7670ceb879dcf29ed150a568e79aaf2194c1ebefad0a081dd84bf2656728e29

  • SSDEEP

    24576:qk/ATig2g7ru5yeO7VeQ0DjrDTlJJn6gz2m1qAJlYQ8xS:zoTr7ru5p4VehDj5KuZ1qAJlT8x

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      ea94ca2f26b68c60d382793f6b138075_JaffaCakes118

    • Size

      1.3MB

    • MD5

      ea94ca2f26b68c60d382793f6b138075

    • SHA1

      68253e94bb46f747e048c160369a95b57bfc3f65

    • SHA256

      eccf0fdd26a4943b1c5bff0b83492d3d605ce23c27a2524167bb76bb9eac8e25

    • SHA512

      3b86b3cd9eda5c443d2e0442ac119792c0edafcc3694c74493278ac01920f06bd7670ceb879dcf29ed150a568e79aaf2194c1ebefad0a081dd84bf2656728e29

    • SSDEEP

      24576:qk/ATig2g7ru5yeO7VeQ0DjrDTlJJn6gz2m1qAJlYQ8xS:zoTr7ru5p4VehDj5KuZ1qAJlT8x

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks