Overview

overview

10

Static

static

3

18ed05e5ac...18.exe

windows7-x64

10

18ed05e5ac...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18ed05e5acdaac76ccb1e6e5a7110e3a_JaffaCakes118

  • Size

    197KB

  • Sample

    241006-vfwqpavcmr

  • MD5

    18ed05e5acdaac76ccb1e6e5a7110e3a

  • SHA1

    31eecee2955933a0f971817af1d081c515f355ea

  • SHA256

    fcba9bf7e20a98a9dd051c4768d49bc921b1822809a8e894b9f62607849a2b29

  • SHA512

    132c5c425e25c1c51943be415c7d2189adf5b6d2d3cb46aca76791e5dabff3bcc8ff1a93498c032a3e226e3817d4fcb041069b2a0ffe9ddf9a9b4f6f2cedf12c

  • SSDEEP

    6144:BsmpyGKnvYkgaVgJmOZk9ojAXiKTqALlI:BsTnvKmOZUojoJI

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      18ed05e5acdaac76ccb1e6e5a7110e3a_JaffaCakes118

    • Size

      197KB

    • MD5

      18ed05e5acdaac76ccb1e6e5a7110e3a

    • SHA1

      31eecee2955933a0f971817af1d081c515f355ea

    • SHA256

      fcba9bf7e20a98a9dd051c4768d49bc921b1822809a8e894b9f62607849a2b29

    • SHA512

      132c5c425e25c1c51943be415c7d2189adf5b6d2d3cb46aca76791e5dabff3bcc8ff1a93498c032a3e226e3817d4fcb041069b2a0ffe9ddf9a9b4f6f2cedf12c

    • SSDEEP

      6144:BsmpyGKnvYkgaVgJmOZk9ojAXiKTqALlI:BsTnvKmOZUojoJI

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks