Overview

overview

10

Static

static

3

fc7667c962...18.exe

windows7-x64

10

fc7667c962...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc7667c962cc70254bdbf5c20490ff8d_JaffaCakes118

  • Size

    986KB

  • Sample

    240928-rfwh5ssdna

  • MD5

    fc7667c962cc70254bdbf5c20490ff8d

  • SHA1

    74b56cd78731c5cf3a2d838aa527ba98ace4af2b

  • SHA256

    dc4f9ccfeed3b040efd67d90e491c115b32887664845a05cc9018263c8116083

  • SHA512

    b0d3ab6053730f4263759df8b58a4947247b8c1ec13c674dc5db826bcbcf4a0d033039cf1412b09792ceb5c90f194d7ee79036f5751763869d3dd8d6bb4cb208

  • SSDEEP

    24576:+MdTTDWpMsrWM8Eoox2AekP1/37sm3DU4SeAqKji2/TV5nJ:+MBTqpx85AekP1sm3D8eO

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      fc7667c962cc70254bdbf5c20490ff8d_JaffaCakes118

    • Size

      986KB

    • MD5

      fc7667c962cc70254bdbf5c20490ff8d

    • SHA1

      74b56cd78731c5cf3a2d838aa527ba98ace4af2b

    • SHA256

      dc4f9ccfeed3b040efd67d90e491c115b32887664845a05cc9018263c8116083

    • SHA512

      b0d3ab6053730f4263759df8b58a4947247b8c1ec13c674dc5db826bcbcf4a0d033039cf1412b09792ceb5c90f194d7ee79036f5751763869d3dd8d6bb4cb208

    • SSDEEP

      24576:+MdTTDWpMsrWM8Eoox2AekP1/37sm3DU4SeAqKji2/TV5nJ:+MBTqpx85AekP1sm3D8eO

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks