Overview

overview

10

Static

static

3

021747066f...18.exe

windows7-x64

10

021747066f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    021747066f9e052f90782827a2be2b5b_JaffaCakes118

  • Size

    520KB

  • Sample

    240930-s2wayaxarc

  • MD5

    021747066f9e052f90782827a2be2b5b

  • SHA1

    78c23045de2babc50d435ae412950ea505e2e6fe

  • SHA256

    db1263b169d2c287892cfb29e1e5d45452dd510cde2aef312aeb3766b01141fa

  • SHA512

    0aa6249d52a58bddcaae81766337f2392904a8b3443dc91472834344fed078c82fd01fbb5eaf4f04830e54d884bf09842b8aceadf27a050cd2f2623e62035120

  • SSDEEP

    12288:bFZzJQlN07E+XzREERZFMv0qIf0RK6BLPYt2IfNyRLvEFDLUJVd:57s07hXzR1XILlIfNyB11

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      021747066f9e052f90782827a2be2b5b_JaffaCakes118

    • Size

      520KB

    • MD5

      021747066f9e052f90782827a2be2b5b

    • SHA1

      78c23045de2babc50d435ae412950ea505e2e6fe

    • SHA256

      db1263b169d2c287892cfb29e1e5d45452dd510cde2aef312aeb3766b01141fa

    • SHA512

      0aa6249d52a58bddcaae81766337f2392904a8b3443dc91472834344fed078c82fd01fbb5eaf4f04830e54d884bf09842b8aceadf27a050cd2f2623e62035120

    • SSDEEP

      12288:bFZzJQlN07E+XzREERZFMv0qIf0RK6BLPYt2IfNyRLvEFDLUJVd:57s07hXzR1XILlIfNyB11

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks