Overview

overview

10

Static

static

3

f9fc70bd59...18.exe

windows7-x64

10

f9fc70bd59...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9fc70bd59683156a745948f4ad2c375_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240927-jdavnavbqd

  • MD5

    f9fc70bd59683156a745948f4ad2c375

  • SHA1

    9fd299fb40b02c6fcc88c73e295956a0192c241e

  • SHA256

    f0c2a8e42aa7e7b9037bf396231eb3f2b116930efc3de9e3ae1ec84a379adaf4

  • SHA512

    4c772362adeba2ac530429db32d2f66a4ca41d5352dda5a5e6b3e4c74b0ee90a0cbbeb1ff50bfbbf1a4ae6bc5fb7d14f0228db741b923d9d27f7c2b25e68af60

  • SSDEEP

    24576:AHvZT6rMHIMzNMA2YN04ofjZM5u19GEy6MSr10pgHgZMJn:IBT6rMHIMzNMA29nrOuTGEZMu10pTZMJ

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      f9fc70bd59683156a745948f4ad2c375_JaffaCakes118

    • Size

      1.1MB

    • MD5

      f9fc70bd59683156a745948f4ad2c375

    • SHA1

      9fd299fb40b02c6fcc88c73e295956a0192c241e

    • SHA256

      f0c2a8e42aa7e7b9037bf396231eb3f2b116930efc3de9e3ae1ec84a379adaf4

    • SHA512

      4c772362adeba2ac530429db32d2f66a4ca41d5352dda5a5e6b3e4c74b0ee90a0cbbeb1ff50bfbbf1a4ae6bc5fb7d14f0228db741b923d9d27f7c2b25e68af60

    • SSDEEP

      24576:AHvZT6rMHIMzNMA2YN04ofjZM5u19GEy6MSr10pgHgZMJn:IBT6rMHIMzNMA29nrOuTGEZMu10pTZMJ

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks