Overview

overview

10

Static

static

3

5edbc0d65e...18.exe

windows7-x64

10

5edbc0d65e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5edbc0d65e572e932f3365d7e020c7ac_JaffaCakes118

  • Size

    503KB

  • Sample

    241019-1rty5atanl

  • MD5

    5edbc0d65e572e932f3365d7e020c7ac

  • SHA1

    450bcd21344d552e9d66dd6793667cd75be226f5

  • SHA256

    2923ede9ba1b549f01dec7ec2cb0504b09914f99dd8d31578ffb2835711f786d

  • SHA512

    5a0b11d1f4404c266a4dcb178aa277729b113c9768137d6fb5ed30267afcdcce228e022690597443aac2e02ca18221dceb50e58c8994282d2fb84c55336108d2

  • SSDEEP

    12288:PWj6dF7cqnrA+e29Au27Uvp32SarIB/wL28WGKTmGfG10tUm/sz2wnZBg:+OdFcq8MeY5ZYC4y8MqGfm0tONnZBg

Score
10/10
ardamaxmodiloaderdiscoverykeyloggerpersistencestealertrojan

Malware Config

Targets

    • Target

      5edbc0d65e572e932f3365d7e020c7ac_JaffaCakes118

    • Size

      503KB

    • MD5

      5edbc0d65e572e932f3365d7e020c7ac

    • SHA1

      450bcd21344d552e9d66dd6793667cd75be226f5

    • SHA256

      2923ede9ba1b549f01dec7ec2cb0504b09914f99dd8d31578ffb2835711f786d

    • SHA512

      5a0b11d1f4404c266a4dcb178aa277729b113c9768137d6fb5ed30267afcdcce228e022690597443aac2e02ca18221dceb50e58c8994282d2fb84c55336108d2

    • SSDEEP

      12288:PWj6dF7cqnrA+e29Au27Uvp32SarIB/wL28WGKTmGfG10tUm/sz2wnZBg:+OdFcq8MeY5ZYC4y8MqGfm0tONnZBg

    Score
    10/10
    ardamaxmodiloaderdiscoverykeyloggerpersistencestealertrojan

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks