Overview

overview

10

Static

static

3

16de2091ad...18.exe

windows7-x64

10

16de2091ad...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16de2091ad28f266218f37f8b4f65f28_JaffaCakes118

  • Size

    557KB

  • Sample

    241005-j11dtsyelf

  • MD5

    16de2091ad28f266218f37f8b4f65f28

  • SHA1

    0654dbe4f6fc3c7575e6063f9f234b220caf5d8b

  • SHA256

    f5e6fc5b2a260e47bf103bf4d09afbe2294824f797c455c5dfce5efa53480d7d

  • SHA512

    0db521aa0102a2937298d162f5fd25fc3b2fef3a8eca04c05bf5a6083a8583a0e7116199c7af8f0cb28ec97b54da4b24059d7f738d7d46b3c92869d454d6cdca

  • SSDEEP

    12288:wRXe4phPAVUOvFY7XsBiwA7xlVxAD2Z/8Etsgy6hbFA:fS2nFY7XciwAHVxsOU2pvA

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      16de2091ad28f266218f37f8b4f65f28_JaffaCakes118

    • Size

      557KB

    • MD5

      16de2091ad28f266218f37f8b4f65f28

    • SHA1

      0654dbe4f6fc3c7575e6063f9f234b220caf5d8b

    • SHA256

      f5e6fc5b2a260e47bf103bf4d09afbe2294824f797c455c5dfce5efa53480d7d

    • SHA512

      0db521aa0102a2937298d162f5fd25fc3b2fef3a8eca04c05bf5a6083a8583a0e7116199c7af8f0cb28ec97b54da4b24059d7f738d7d46b3c92869d454d6cdca

    • SSDEEP

      12288:wRXe4phPAVUOvFY7XsBiwA7xlVxAD2Z/8Etsgy6hbFA:fS2nFY7XciwAHVxsOU2pvA

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks