Overview

overview

10

Static

static

3

16937278ba...18.exe

windows7-x64

10

16937278ba...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16937278babb696887c738b3bae3b3b4_JaffaCakes118

  • Size

    5.1MB

  • Sample

    241005-hgvhssvere

  • MD5

    16937278babb696887c738b3bae3b3b4

  • SHA1

    eb66cb3ae86bf8646071f5189c6dacc449a091ce

  • SHA256

    0e42a4f4ead2f7521f48b9f845512a3be0517328b20882a7ed6e8d678c037707

  • SHA512

    07bae232188e9cdca3d28026dae0fbd464c37a8662e740bb0624aa0182aa4a5edac2c42be5c352bb90ad8234e7d9c88b710a535b43d6e538e29755677d7a3d6c

  • SSDEEP

    98304:1hzJHfEMAoGP+byVJYA4zEH8Tl2rkHX+5LZzSXPMWL/ySiQdSaU7KhCsCRNVjsw7:3VEMAoG26J5ctTNHYzSX08/5iQdSjSCn

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      16937278babb696887c738b3bae3b3b4_JaffaCakes118

    • Size

      5.1MB

    • MD5

      16937278babb696887c738b3bae3b3b4

    • SHA1

      eb66cb3ae86bf8646071f5189c6dacc449a091ce

    • SHA256

      0e42a4f4ead2f7521f48b9f845512a3be0517328b20882a7ed6e8d678c037707

    • SHA512

      07bae232188e9cdca3d28026dae0fbd464c37a8662e740bb0624aa0182aa4a5edac2c42be5c352bb90ad8234e7d9c88b710a535b43d6e538e29755677d7a3d6c

    • SSDEEP

      98304:1hzJHfEMAoGP+byVJYA4zEH8Tl2rkHX+5LZzSXPMWL/ySiQdSaU7KhCsCRNVjsw7:3VEMAoG26J5ctTNHYzSX08/5iQdSjSCn

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks