Overview

overview

10

Static

static

3

0f5f2e640e...18.exe

windows7-x64

10

0f5f2e640e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f5f2e640ed8bfb8d23cdc99a1d1b586_JaffaCakes118

  • Size

    2.5MB

  • Sample

    241003-swfnassejp

  • MD5

    0f5f2e640ed8bfb8d23cdc99a1d1b586

  • SHA1

    a08db0712aa28c3c7f9e80270acb568ec77e14a7

  • SHA256

    ef90f55d789dc83abda7fad3e66cd87a0069fe0439ed31b0611db5e30a3d66b5

  • SHA512

    717aa5248f21ad8c5a30dc74a1ae28b177e31ddacb329766457f70c2fc3fa045450513df7bf6685cab34d6c56c96c919dfcfb5282ae0bde6aa499c295ca7a59b

  • SSDEEP

    49152:F5Geq1NlCqtFuVZwOMCODC5Geq1NlCqtFuVZwOMCODz:6eq1ptFUZkDD5eq1ptFUZkDDz

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      0f5f2e640ed8bfb8d23cdc99a1d1b586_JaffaCakes118

    • Size

      2.5MB

    • MD5

      0f5f2e640ed8bfb8d23cdc99a1d1b586

    • SHA1

      a08db0712aa28c3c7f9e80270acb568ec77e14a7

    • SHA256

      ef90f55d789dc83abda7fad3e66cd87a0069fe0439ed31b0611db5e30a3d66b5

    • SHA512

      717aa5248f21ad8c5a30dc74a1ae28b177e31ddacb329766457f70c2fc3fa045450513df7bf6685cab34d6c56c96c919dfcfb5282ae0bde6aa499c295ca7a59b

    • SSDEEP

      49152:F5Geq1NlCqtFuVZwOMCODC5Geq1NlCqtFuVZwOMCODz:6eq1ptFUZkDD5eq1ptFUZkDDz

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks