Overview

overview

10

Static

static

7

4314436b36...18.exe

windows7-x64

10

4314436b36...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4314436b36c912bf40b3394f70dbd426_JaffaCakes118

  • Size

    4.1MB

  • Sample

    241014-tve6tatgmh

  • MD5

    4314436b36c912bf40b3394f70dbd426

  • SHA1

    14ae149c7a149a2590054fe4b68bd3430dd7a9af

  • SHA256

    e93f113896997f86b3274d504758dcd2b937820a6192f2b1afc5add2de675a58

  • SHA512

    97583d871270c496b0d819dd8618ccddcbcc9e68f61abfc993b8b6b32e3ca5abcd79881ebb96f605b89bb355e951b02d602d035b1a3816bd2fc35ed4cd85fc2f

  • SSDEEP

    98304:GG245NjRe6J6y8Wat7JrRexSPdNk0QJcSD8pHfwdRkhGyFCnBKXE:lR5N/Qt7dkxskrD8JYzqBFkt

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealerthemidaupx

Malware Config

Targets

    • Target

      4314436b36c912bf40b3394f70dbd426_JaffaCakes118

    • Size

      4.1MB

    • MD5

      4314436b36c912bf40b3394f70dbd426

    • SHA1

      14ae149c7a149a2590054fe4b68bd3430dd7a9af

    • SHA256

      e93f113896997f86b3274d504758dcd2b937820a6192f2b1afc5add2de675a58

    • SHA512

      97583d871270c496b0d819dd8618ccddcbcc9e68f61abfc993b8b6b32e3ca5abcd79881ebb96f605b89bb355e951b02d602d035b1a3816bd2fc35ed4cd85fc2f

    • SSDEEP

      98304:GG245NjRe6J6y8Wat7JrRexSPdNk0QJcSD8pHfwdRkhGyFCnBKXE:lR5N/Qt7dkxskrD8JYzqBFkt

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealerthemidaupx

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks