Overview

overview

10

Static

static

3

39d64dc22f...18.exe

windows7-x64

10

39d64dc22f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39d64dc22fe4e4c221f0cdb5efabc767_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241012-nwjbzaydph

  • MD5

    39d64dc22fe4e4c221f0cdb5efabc767

  • SHA1

    2fc5e956b3d6cdb9b17f40b3edd547ffcc17859d

  • SHA256

    1de545d46ee31e37d2fb6686a1ce9896cc7d46d1b29484ac771c64cb80ee3c63

  • SHA512

    a350aea72f5634dcefd94832b0dd0dc9ba5eae3c17263472cf402f62a41db924934da92dd31e6b52f454a661e7d738f2f67646ed02a99f59fbed814da41e62e8

  • SSDEEP

    24576:tbPTVJrfUUwlkHiuh55B1hE/yW9OQZ5R79cR+/A8UJurlCziR0DwkwDdph:t7TVJr86Cut+/yWlJ7f4Upk+dp

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealerupx

Malware Config

Targets

    • Target

      39d64dc22fe4e4c221f0cdb5efabc767_JaffaCakes118

    • Size

      1.3MB

    • MD5

      39d64dc22fe4e4c221f0cdb5efabc767

    • SHA1

      2fc5e956b3d6cdb9b17f40b3edd547ffcc17859d

    • SHA256

      1de545d46ee31e37d2fb6686a1ce9896cc7d46d1b29484ac771c64cb80ee3c63

    • SHA512

      a350aea72f5634dcefd94832b0dd0dc9ba5eae3c17263472cf402f62a41db924934da92dd31e6b52f454a661e7d738f2f67646ed02a99f59fbed814da41e62e8

    • SSDEEP

      24576:tbPTVJrfUUwlkHiuh55B1hE/yW9OQZ5R79cR+/A8UJurlCziR0DwkwDdph:t7TVJr86Cut+/yWlJ7f4Upk+dp

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealerupx

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks