Overview

overview

10

Static

static

3

13b3276da0...18.exe

windows7-x64

10

13b3276da0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13b3276da0ff0d6581786fc3cd90cef1_JaffaCakes118

  • Size

    481KB

  • Sample

    241004-rl7tcsydnr

  • MD5

    13b3276da0ff0d6581786fc3cd90cef1

  • SHA1

    f75077e24c30c101da1c66c471eac59647979456

  • SHA256

    defcc591ea0bd01d484fe3852ea352aa7ea78ab7e5014089580c02cb18730a8f

  • SHA512

    f626a1e70db4dd3b2c635f820831c4659efc832fdfe5c95b713cf90370ff2831ee1da2c522cbddd522b27ca39c322170967c32ab49dd0315643124b44b88ee29

  • SSDEEP

    12288:e/gjPCJqQfqaVEZ1rKp3AWdgYOgDX6YJzHBn9NdPF0eHs+:XjPCJfqNZ1rKxAW1L76Kn9NtF0eHV

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      13b3276da0ff0d6581786fc3cd90cef1_JaffaCakes118

    • Size

      481KB

    • MD5

      13b3276da0ff0d6581786fc3cd90cef1

    • SHA1

      f75077e24c30c101da1c66c471eac59647979456

    • SHA256

      defcc591ea0bd01d484fe3852ea352aa7ea78ab7e5014089580c02cb18730a8f

    • SHA512

      f626a1e70db4dd3b2c635f820831c4659efc832fdfe5c95b713cf90370ff2831ee1da2c522cbddd522b27ca39c322170967c32ab49dd0315643124b44b88ee29

    • SSDEEP

      12288:e/gjPCJqQfqaVEZ1rKp3AWdgYOgDX6YJzHBn9NdPF0eHs+:XjPCJfqNZ1rKxAW1L76Kn9NtF0eHV

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks