Overview

overview

10

Static

static

3

fc98de9f15...18.exe

windows7-x64

10

fc98de9f15...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc98de9f15ca1a2ef433c2a830ded2e2_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240928-sxegmavhpc

  • MD5

    fc98de9f15ca1a2ef433c2a830ded2e2

  • SHA1

    aaf33a03ecd7b0196482aca1b35ed07e7b2870ca

  • SHA256

    20380cbd8ce0dbf4bbfd7ee1b9706859dc0dbf70adcb2b1c5aa2cb3d9b868c62

  • SHA512

    87acaa131cfaecab58ad4453ce895707f1da04e08a29e817b9472e33d9023d8b7113ff028236fe502447346b3b1ba959f8e438a8a6af4951d4ea6f08a75f2aeb

  • SSDEEP

    24576:GZxTUydgw6/1xvZCxKXAimGx0miYrPc2s83Vu0:GXTPixvZC8XAc0lC3Vu

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      fc98de9f15ca1a2ef433c2a830ded2e2_JaffaCakes118

    • Size

      1.2MB

    • MD5

      fc98de9f15ca1a2ef433c2a830ded2e2

    • SHA1

      aaf33a03ecd7b0196482aca1b35ed07e7b2870ca

    • SHA256

      20380cbd8ce0dbf4bbfd7ee1b9706859dc0dbf70adcb2b1c5aa2cb3d9b868c62

    • SHA512

      87acaa131cfaecab58ad4453ce895707f1da04e08a29e817b9472e33d9023d8b7113ff028236fe502447346b3b1ba959f8e438a8a6af4951d4ea6f08a75f2aeb

    • SSDEEP

      24576:GZxTUydgw6/1xvZCxKXAimGx0miYrPc2s83Vu0:GXTPixvZC8XAc0lC3Vu

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks