Overview

overview

10

Static

static

3

5c3b93dbc9...18.exe

windows7-x64

10

5c3b93dbc9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c3b93dbc9b88061faf20b56d65e7596_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241019-mq5scatepj

  • MD5

    5c3b93dbc9b88061faf20b56d65e7596

  • SHA1

    92b7506a2324c216773b6fc8b0df870e6d67a398

  • SHA256

    384512e0952a8663b228148cc1410b6e018754b33ba98952afc673edcb3811fe

  • SHA512

    8d1394516fd4e619611f614a3cb2ba9ccedc179f5945b36abdf206cad4b032bad55d72c75aeb5aa9a7ad27bc59f9c24087509921b3840646ee5e0a4d3a8e0120

  • SSDEEP

    24576:7ZxT0uOFJ36bSqKMIqslSsuI8A7iIa9KFXku9gN8Eq75d81oHl4pLR:7XTfOFJ36b3KskSs9294V9gN8V75

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      5c3b93dbc9b88061faf20b56d65e7596_JaffaCakes118

    • Size

      1.3MB

    • MD5

      5c3b93dbc9b88061faf20b56d65e7596

    • SHA1

      92b7506a2324c216773b6fc8b0df870e6d67a398

    • SHA256

      384512e0952a8663b228148cc1410b6e018754b33ba98952afc673edcb3811fe

    • SHA512

      8d1394516fd4e619611f614a3cb2ba9ccedc179f5945b36abdf206cad4b032bad55d72c75aeb5aa9a7ad27bc59f9c24087509921b3840646ee5e0a4d3a8e0120

    • SSDEEP

      24576:7ZxT0uOFJ36bSqKMIqslSsuI8A7iIa9KFXku9gN8Eq75d81oHl4pLR:7XTfOFJ36b3KskSs9294V9gN8V75

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks