Overview

overview

10

Static

static

3

Aura Kasih.3gp.exe

windows7-x64

10

Aura Kasih.3gp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7595dc5cdb6f4bf1e507a177802646c_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240926-ctrpsasajm

  • MD5

    f7595dc5cdb6f4bf1e507a177802646c

  • SHA1

    71890dcda16d513ec5dc88a68217a154b8045cb7

  • SHA256

    9107df88a4769554b7f49a7f10a79446c3c2e9769405b1a38522c48e2a0dd734

  • SHA512

    919f4403a7f7f3bb833b47356dcfc9833a6f7ba613a8af44623fb29295649a022df08fb0517f556b37048a0634f498e843865bd49063742f3ddd1daeff09ca96

  • SSDEEP

    24576:5GywvGoVXz3juBG2zZo2dgLkUsr5KEC8d4VTB2l/2nNuoUArtRQwTiFf+8IS82N:MjCBG2zQkPr5KL8d4be+nNuwRQqQf+8t

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      Aura Kasih.3gp.exe

    • Size

      1.6MB

    • MD5

      58488c76e6d0fd22564e21404013b5a5

    • SHA1

      99490d02a265fca0b0bc9e872ad97692b0d15180

    • SHA256

      381b23777603322ccaf6a8bfe5454f35aa6c8aba83b2d4a10a0f8634edeba592

    • SHA512

      81d74d9816be07cbc0d0e9b8429b112d53c79dd230764333cfdcb159d11475eb6f881c0862c6b76f3d8e379139f89c80343222f05e8ab990d3311a478ae58112

    • SSDEEP

      24576:3jqLBz+pKrlmMDRA7ELOh8iy0XYUlG2oBmyNE9PoH4xnJGmxW4fP2PgcBH:3GBiLMFAA+5X/zs+oTMW4fPu

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks