Overview

overview

10

Static

static

3

ef8a49effb...18.exe

windows7-x64

10

ef8a49effb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef8a49effb810c7f0db49f2d02649e65_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240921-lw4lsswdmd

  • MD5

    ef8a49effb810c7f0db49f2d02649e65

  • SHA1

    330e77fb34c3eefd7ab577f2618e30cc9fe570b3

  • SHA256

    1d5be759cedf6727c0c65837384e8c58e84ce15e428eb852365b49766e1c1a40

  • SHA512

    1e51487b78f55a11eade4a1429effcfd5086efb36a9328f44433d9081ca3fe4ab3e0ca2ecd2a91ae4f3a14cdfe06039f97384419a6105e2021e481cafe08d287

  • SSDEEP

    24576:tH0KuTbjxJOjbSR3Y1Ax8TayKiKvi/7rC0pDPJ9Nk/AYUoG/YSVWPWce:tH0RTbjyjbSR3Y1/2iCi/7rZ9AAYbGxb

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      ef8a49effb810c7f0db49f2d02649e65_JaffaCakes118

    • Size

      1.1MB

    • MD5

      ef8a49effb810c7f0db49f2d02649e65

    • SHA1

      330e77fb34c3eefd7ab577f2618e30cc9fe570b3

    • SHA256

      1d5be759cedf6727c0c65837384e8c58e84ce15e428eb852365b49766e1c1a40

    • SHA512

      1e51487b78f55a11eade4a1429effcfd5086efb36a9328f44433d9081ca3fe4ab3e0ca2ecd2a91ae4f3a14cdfe06039f97384419a6105e2021e481cafe08d287

    • SSDEEP

      24576:tH0KuTbjxJOjbSR3Y1Ax8TayKiKvi/7rC0pDPJ9Nk/AYUoG/YSVWPWce:tH0RTbjyjbSR3Y1/2iCi/7rZ9AAYbGxb

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks