Overview

overview

10

Static

static

3

ed454da522...18.exe

windows7-x64

10

ed454da522...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed454da52205d617a86d28101aeb41ac_JaffaCakes118

  • Size

    1004KB

  • Sample

    240920-k4sntsyenb

  • MD5

    ed454da52205d617a86d28101aeb41ac

  • SHA1

    3dbc93ce3f4719a91f9ec3224fad3959ccc4b9e5

  • SHA256

    c1b4038d33cd9ff893b363969681e51c66382a2c38faed60ba1db884ee5b8948

  • SHA512

    ba8e0492e14ad323f05f32f493ecdd6938a9e25709f957db98e85bd16941cf011cbf50dd0a7189fdbf441fc2c4b8c5ddc5cc58638aba223e49a72fd75e93c122

  • SSDEEP

    24576:XjXTjx296XDo7lfiOQmoAFj8zcxibjreYhGNPnUn:XDTjx/OlfZP9p8zQiNcPnS

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      ed454da52205d617a86d28101aeb41ac_JaffaCakes118

    • Size

      1004KB

    • MD5

      ed454da52205d617a86d28101aeb41ac

    • SHA1

      3dbc93ce3f4719a91f9ec3224fad3959ccc4b9e5

    • SHA256

      c1b4038d33cd9ff893b363969681e51c66382a2c38faed60ba1db884ee5b8948

    • SHA512

      ba8e0492e14ad323f05f32f493ecdd6938a9e25709f957db98e85bd16941cf011cbf50dd0a7189fdbf441fc2c4b8c5ddc5cc58638aba223e49a72fd75e93c122

    • SSDEEP

      24576:XjXTjx296XDo7lfiOQmoAFj8zcxibjreYhGNPnUn:XDTjx/OlfZP9p8zQiNcPnS

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks