Overview

overview

10

Static

static

3

371b507c1b...18.exe

windows7-x64

10

371b507c1b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    371b507c1bccc29a87fa937624c51653_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241011-2bvq6axdjf

  • MD5

    371b507c1bccc29a87fa937624c51653

  • SHA1

    59166596ed8fd53ac82255b7a64fd5d46a28fccd

  • SHA256

    45338f9934aa032b45013abff8ee83a3eee670e391e15226205f6339a46df98d

  • SHA512

    c92d6504eb64f0203415a400a998ec5fb7e397c350fdf9bd625b20559a8ba52110b33430c6499720846940fa9b19ccc32b61c7b3da6126ab53a0af3628e05e03

  • SSDEEP

    24576:sU4oTB9zq8avQdTgskFK2IhwVFYAH82rpy3GIPNg7b3PH3/sbsV9ZIbPVnO:sULTbJsK2+Wp4GQ43PX/sgVGV

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      371b507c1bccc29a87fa937624c51653_JaffaCakes118

    • Size

      1.2MB

    • MD5

      371b507c1bccc29a87fa937624c51653

    • SHA1

      59166596ed8fd53ac82255b7a64fd5d46a28fccd

    • SHA256

      45338f9934aa032b45013abff8ee83a3eee670e391e15226205f6339a46df98d

    • SHA512

      c92d6504eb64f0203415a400a998ec5fb7e397c350fdf9bd625b20559a8ba52110b33430c6499720846940fa9b19ccc32b61c7b3da6126ab53a0af3628e05e03

    • SSDEEP

      24576:sU4oTB9zq8avQdTgskFK2IhwVFYAH82rpy3GIPNg7b3PH3/sbsV9ZIbPVnO:sULTbJsK2+Wp4GQ43PX/sgVGV

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks