Overview

overview

10

Static

static

3

0c4d69452f...18.exe

windows7-x64

10

0c4d69452f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c4d69452fe818fd0117ec239c2943eb_JaffaCakes118

  • Size

    196KB

  • Sample

    241002-yzlxdaxhkb

  • MD5

    0c4d69452fe818fd0117ec239c2943eb

  • SHA1

    72db664da6857c647dbe32501d94c0ee38afcdec

  • SHA256

    125d86f0d7cd8c22d44f3f7c5cc02ad658aace1243be5b85af2fe7a211f711a4

  • SHA512

    fa5a57ed9f4e8f914283aa34526ed4ced1361c0f82bf3ca9f6ca351eabe3788afa59ac6ffd79d06c9815385050cefe6fe0dbf2202f5f27488623d99f03da71ac

  • SSDEEP

    3072:7zCNmpyGzKOrzdZj+xYo0+DUmKXSmm6hoiHJZS75tkAPaWWOc62j14E:7smpyGjrzd9Z+bKfmWXrS7rVPaWlcKE

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      0c4d69452fe818fd0117ec239c2943eb_JaffaCakes118

    • Size

      196KB

    • MD5

      0c4d69452fe818fd0117ec239c2943eb

    • SHA1

      72db664da6857c647dbe32501d94c0ee38afcdec

    • SHA256

      125d86f0d7cd8c22d44f3f7c5cc02ad658aace1243be5b85af2fe7a211f711a4

    • SHA512

      fa5a57ed9f4e8f914283aa34526ed4ced1361c0f82bf3ca9f6ca351eabe3788afa59ac6ffd79d06c9815385050cefe6fe0dbf2202f5f27488623d99f03da71ac

    • SSDEEP

      3072:7zCNmpyGzKOrzdZj+xYo0+DUmKXSmm6hoiHJZS75tkAPaWWOc62j14E:7smpyGjrzd9Z+bKfmWXrS7rVPaWlcKE

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks