General

  • Target

    391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241012-j2rhba1eqg

  • MD5

    391ab4b67cb9dff5dc2aa428d32a0c1d

  • SHA1

    25a761373cf674c37ff326755a42b99b627d9811

  • SHA256

    0e94dc6ed2c79b43e33e3d490db83e715cfbbe568670babed76990a072ac564f

  • SHA512

    73f8891ef05192c3ab4c0478ff2f3e7840d3f3bb605bc5262fbcee13eca68aa9b51cd029b13a512aea7782a79202e6a3d1a3420314a409ba486cb9ce75c93c3e

  • SSDEEP

    24576:lk/AT2aOrriL5O9qckCvQGJ2nkreQNtAvITbeI4fSRyuoSmWPb1fDoxU:6oT2aQridOw7wV2kTRpFfpLo

Malware Config

Targets

    • Target

      391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118

    • Size

      1.2MB

    • MD5

      391ab4b67cb9dff5dc2aa428d32a0c1d

    • SHA1

      25a761373cf674c37ff326755a42b99b627d9811

    • SHA256

      0e94dc6ed2c79b43e33e3d490db83e715cfbbe568670babed76990a072ac564f

    • SHA512

      73f8891ef05192c3ab4c0478ff2f3e7840d3f3bb605bc5262fbcee13eca68aa9b51cd029b13a512aea7782a79202e6a3d1a3420314a409ba486cb9ce75c93c3e

    • SSDEEP

      24576:lk/AT2aOrriL5O9qckCvQGJ2nkreQNtAvITbeI4fSRyuoSmWPb1fDoxU:6oT2aQridOw7wV2kTRpFfpLo

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks