Overview

overview

10

Static

static

3

23af1c279a...18.exe

windows7-x64

10

23af1c279a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    23af1c279adfc46b5b7c478dfa1d3b87_JaffaCakes118

  • Size

    310KB

  • Sample

    241008-xelv7stclp

  • MD5

    23af1c279adfc46b5b7c478dfa1d3b87

  • SHA1

    d0dc29d7e830c938444f27c7c10420fe4268221a

  • SHA256

    7c65450e7a66099c219b085a69782452ff0e9e7a417af2438df503c1c457f73f

  • SHA512

    6d2cb70e22234e510925bbbcb26898f9275b7a1413f364d6685e9d634deac2ab27fd5d26a7036689f9df0f77bdc38c9b000ef024c6f1fd3bfc598f20831f32be

  • SSDEEP

    6144:bRov6OdCxRME+If4KB+5k2Sfznz5+PYjz6vUeuOzbO8Qy:bGHaMhI9uk2A8Yv6vruOzQy

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      23af1c279adfc46b5b7c478dfa1d3b87_JaffaCakes118

    • Size

      310KB

    • MD5

      23af1c279adfc46b5b7c478dfa1d3b87

    • SHA1

      d0dc29d7e830c938444f27c7c10420fe4268221a

    • SHA256

      7c65450e7a66099c219b085a69782452ff0e9e7a417af2438df503c1c457f73f

    • SHA512

      6d2cb70e22234e510925bbbcb26898f9275b7a1413f364d6685e9d634deac2ab27fd5d26a7036689f9df0f77bdc38c9b000ef024c6f1fd3bfc598f20831f32be

    • SSDEEP

      6144:bRov6OdCxRME+If4KB+5k2Sfznz5+PYjz6vUeuOzbO8Qy:bGHaMhI9uk2A8Yv6vruOzQy

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks