Overview

overview

10

Static

static

3

CRl.exe

windows7-x64

10

CRl.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb71a889b5967d99a6cb96e3802a53c7_JaffaCakes118

  • Size

    814KB

  • Sample

    240919-qw1mcs1cld

  • MD5

    eb71a889b5967d99a6cb96e3802a53c7

  • SHA1

    7818d8c4aaa0f39680830a5be7a361dd93033741

  • SHA256

    7ba7b8cb63b0d82f25c66b8f350b182969895ea206b99a06bcff3ea89f92a0a5

  • SHA512

    4794ce6c3ef996ca23b31d9de2d6daaefd4f42769c38bc1b22182cddbca810b4a412dfc329751a347f40658707de9adef7487f256b866aae526e65280f47d1a2

  • SSDEEP

    24576:RD8HIdZyGspOyp4EXNdwdikWV8IrKDqRt4:RDj4/FPaiFFbRt4

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      CRl.exe

    • Size

      821KB

    • MD5

      f42c4e5fc61e8b7bb7d370a64e74fa6b

    • SHA1

      b40714b04fa3f646d42b4ed76b62f784ca865a39

    • SHA256

      2a899a5c72bf148338007d4c58e54deb2d66a93d5a1bf8b7a571d277da3c1590

    • SHA512

      971836a5f02fbe5834510dc62e2a6c5088d017d47a3648d05ac0d97b2911c36e88ba59b81cb44a1cb5724eb5e59836fe9df8792268528ad47fdcd7d1cc02bb4c

    • SSDEEP

      12288:xEWGzWE+z4oM2X7UU1+G6slP9iLAKPBP5NKcoAnWagmgb3LEn8zLPZnW3STF/VR2:qKrUADlP9VKpxNWAWaZgQK43OF7LRqxx

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks