Overview

overview

10

Static

static

3

fdafc23087...18.exe

windows7-x64

10

fdafc23087...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdafc2308715ce40247da1f8ce88f448_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240929-dn9h3sxfnn

  • MD5

    fdafc2308715ce40247da1f8ce88f448

  • SHA1

    ea9a5e8e9d87cb9ae403fd50e7e56f2d54e3a66c

  • SHA256

    18081790bc35e40a0847e75df2a4ba20d20e8c46e69a4cc39398a1231a0bd310

  • SHA512

    cad2f30519f2a25ab43507b19249ceb5a768cd37458626bb9573c1ea8cfd64525e0b054bc9b6bd3da9f1227c8794a2cff03db21a1984d1245bbd4df322bd2ac6

  • SSDEEP

    24576:W4C/ikmzV8Lp0JB4n3lGKEhPvZS85OpZ896jXiR6JOaVV1ioLo/sH:cd30Jq1GHhPvZ75h6MWOAV1ioU/sH

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      fdafc2308715ce40247da1f8ce88f448_JaffaCakes118

    • Size

      1.2MB

    • MD5

      fdafc2308715ce40247da1f8ce88f448

    • SHA1

      ea9a5e8e9d87cb9ae403fd50e7e56f2d54e3a66c

    • SHA256

      18081790bc35e40a0847e75df2a4ba20d20e8c46e69a4cc39398a1231a0bd310

    • SHA512

      cad2f30519f2a25ab43507b19249ceb5a768cd37458626bb9573c1ea8cfd64525e0b054bc9b6bd3da9f1227c8794a2cff03db21a1984d1245bbd4df322bd2ac6

    • SSDEEP

      24576:W4C/ikmzV8Lp0JB4n3lGKEhPvZS85OpZ896jXiR6JOaVV1ioLo/sH:cd30Jq1GHhPvZ75h6MWOAV1ioU/sH

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks