General

  • Target

    14f332618f7de37ac19edec443763116_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241004-z5w5za1era

  • MD5

    14f332618f7de37ac19edec443763116

  • SHA1

    ec382ad6daa977cd223a074388059a9664a560d5

  • SHA256

    8553c39295085aaaac494c6dfcc3fec4e59ad594d597c94a7e17be8138beff3f

  • SHA512

    ac40b431f7b30057b49b461e525f552205c87bda25063b3370448d9c8fc88ecd343609bbd49061356dfd0bfc6baa21ed23258872b2e9225b61acbcbae0902168

  • SSDEEP

    24576:LZxTBtq9dFVHyESL0YXWtGAVHNJX0qXcOXbs3TUkRTutRh3JhYzmBGTyxfpLoNKj:LXTq9yESINGCtaqnLsjUFn3xcT2fpLS

Malware Config

Targets

    • Target

      14f332618f7de37ac19edec443763116_JaffaCakes118

    • Size

      1.3MB

    • MD5

      14f332618f7de37ac19edec443763116

    • SHA1

      ec382ad6daa977cd223a074388059a9664a560d5

    • SHA256

      8553c39295085aaaac494c6dfcc3fec4e59ad594d597c94a7e17be8138beff3f

    • SHA512

      ac40b431f7b30057b49b461e525f552205c87bda25063b3370448d9c8fc88ecd343609bbd49061356dfd0bfc6baa21ed23258872b2e9225b61acbcbae0902168

    • SSDEEP

      24576:LZxTBtq9dFVHyESL0YXWtGAVHNJX0qXcOXbs3TUkRTutRh3JhYzmBGTyxfpLoNKj:LXTq9yESINGCtaqnLsjUFn3xcT2fpLS

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks