Overview

overview

10

Static

static

3

315d477991...18.exe

windows7-x64

10

315d477991...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    315d4779918d33282cbd9dcda4aa3300_JaffaCakes118

  • Size

    560KB

  • Sample

    241010-w9bs2swcmp

  • MD5

    315d4779918d33282cbd9dcda4aa3300

  • SHA1

    1955032464ce611bce3a3470e69b301cc1756dca

  • SHA256

    2c492268d97b50850b422480ba3b0b015091b7eec63436f43a3c36c1db98e6d9

  • SHA512

    ab831762c89bda450b53261a09ea92eb6457919e0013bf844e3807b11161a75c4936dd370fc548d62fd5196927c84ef0f3afbe63483daf6dadcdd998a0551de0

  • SSDEEP

    12288:9lhe0vpz6jfiyFeMgOS46ARgpgFv+8DS+lWh1iExSmpXSScpsho:A0vpQfpFeXOCAReg1+Lh7NXSFpCo

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      315d4779918d33282cbd9dcda4aa3300_JaffaCakes118

    • Size

      560KB

    • MD5

      315d4779918d33282cbd9dcda4aa3300

    • SHA1

      1955032464ce611bce3a3470e69b301cc1756dca

    • SHA256

      2c492268d97b50850b422480ba3b0b015091b7eec63436f43a3c36c1db98e6d9

    • SHA512

      ab831762c89bda450b53261a09ea92eb6457919e0013bf844e3807b11161a75c4936dd370fc548d62fd5196927c84ef0f3afbe63483daf6dadcdd998a0551de0

    • SSDEEP

      12288:9lhe0vpz6jfiyFeMgOS46ARgpgFv+8DS+lWh1iExSmpXSScpsho:A0vpQfpFeXOCAReg1+Lh7NXSFpCo

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks