Overview

overview

10

Static

static

3

550e844746...18.exe

windows7-x64

10

550e844746...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    550e8447463fdf645c99628f37b7304f_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241018-c9gvhsvhkj

  • MD5

    550e8447463fdf645c99628f37b7304f

  • SHA1

    d1cd3e9f0177e961693b949ee8a563b1ce19cafa

  • SHA256

    6d6e2537d0768cfe68b2df5a2a5e2c8edcc9385ead1bb73bf34782bf1ea996af

  • SHA512

    37e55abcbb332ac8c099e6a835ce40256d4e93dbf98251f29d733a5a0a7b261cec556a39a5ca460acd8b36c9c9ee78918bf0165e7d79c0dc4322d3dd936d8f5e

  • SSDEEP

    24576:dU4oTWNGHdMtWoJrW9XCtNZr6HGISgEuS7eJw:dULTWMdMtWarW2sGyEuj

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      550e8447463fdf645c99628f37b7304f_JaffaCakes118

    • Size

      1.1MB

    • MD5

      550e8447463fdf645c99628f37b7304f

    • SHA1

      d1cd3e9f0177e961693b949ee8a563b1ce19cafa

    • SHA256

      6d6e2537d0768cfe68b2df5a2a5e2c8edcc9385ead1bb73bf34782bf1ea996af

    • SHA512

      37e55abcbb332ac8c099e6a835ce40256d4e93dbf98251f29d733a5a0a7b261cec556a39a5ca460acd8b36c9c9ee78918bf0165e7d79c0dc4322d3dd936d8f5e

    • SSDEEP

      24576:dU4oTWNGHdMtWoJrW9XCtNZr6HGISgEuS7eJw:dULTWMdMtWarW2sGyEuj

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks