Overview

overview

10

Static

static

3

19471f98e6...18.exe

windows7-x64

10

19471f98e6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19471f98e68f19bce203dfc964eaaadb_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241006-xj7ngazdrj

  • MD5

    19471f98e68f19bce203dfc964eaaadb

  • SHA1

    c2f4eeb37a05f4e43b6ea825df5afb96bb0dbf5b

  • SHA256

    73a92df3abe0565f65eb72f7d82999007741bb1eff7ca081dd6e784b346bb976

  • SHA512

    d96396ccfd4002d46106b769883f7dba4a1a3a09a6c489b1ee703c73137817bfd5c1361e1a1afdc55de99b42f4727f4b9568f2da0af899da5a3c8959730dad3c

  • SSDEEP

    24576:euIIABU/pT/luS5EEdbb40C82oX3PWcy/4PMn7S+06/FDJU5ve:euINuRT/ltHZbV2oWcy/97SH2DQe

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      19471f98e68f19bce203dfc964eaaadb_JaffaCakes118

    • Size

      1.2MB

    • MD5

      19471f98e68f19bce203dfc964eaaadb

    • SHA1

      c2f4eeb37a05f4e43b6ea825df5afb96bb0dbf5b

    • SHA256

      73a92df3abe0565f65eb72f7d82999007741bb1eff7ca081dd6e784b346bb976

    • SHA512

      d96396ccfd4002d46106b769883f7dba4a1a3a09a6c489b1ee703c73137817bfd5c1361e1a1afdc55de99b42f4727f4b9568f2da0af899da5a3c8959730dad3c

    • SSDEEP

      24576:euIIABU/pT/luS5EEdbb40C82oX3PWcy/4PMn7S+06/FDJU5ve:euINuRT/ltHZbV2oWcy/97SH2DQe

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks