Overview

overview

10

Static

static

3

f26f7b2229...18.exe

windows7-x64

10

f26f7b2229...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f26f7b2229f054390927633ba61503c9_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240922-vgq7lazfkm

  • MD5

    f26f7b2229f054390927633ba61503c9

  • SHA1

    5086ddfc8d07354116c7d8dc2654849537fc25ce

  • SHA256

    05d2afe450d8c8591ef4f655e7a2e3a4b6d41f02312c426a9cc9a3f1de50cec1

  • SHA512

    df2f23b4bee2993cfdc9344fa14d01e38b72e8879063ce50a813a6d267d9eb411f020fb519cca622a49ecda4d42f20c361646bdaaa34c0d693424241293daafb

  • SSDEEP

    24576:Rav02/FBa7o6tm4ZqRieZqRgHUSD69m7uUPUA8dzjPmTzUGgn5:0i0if1SDM6EA8V+8Zn5

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      f26f7b2229f054390927633ba61503c9_JaffaCakes118

    • Size

      1.4MB

    • MD5

      f26f7b2229f054390927633ba61503c9

    • SHA1

      5086ddfc8d07354116c7d8dc2654849537fc25ce

    • SHA256

      05d2afe450d8c8591ef4f655e7a2e3a4b6d41f02312c426a9cc9a3f1de50cec1

    • SHA512

      df2f23b4bee2993cfdc9344fa14d01e38b72e8879063ce50a813a6d267d9eb411f020fb519cca622a49ecda4d42f20c361646bdaaa34c0d693424241293daafb

    • SSDEEP

      24576:Rav02/FBa7o6tm4ZqRieZqRgHUSD69m7uUPUA8dzjPmTzUGgn5:0i0if1SDM6EA8V+8Zn5

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks