Overview

overview

10

Static

static

3

6008b7dbdb...18.exe

windows7-x64

10

6008b7dbdb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6008b7dbdb784a44d3e37e5609b322ae_JaffaCakes118

  • Size

    740KB

  • Sample

    241020-dgs8hsxbll

  • MD5

    6008b7dbdb784a44d3e37e5609b322ae

  • SHA1

    1c7cc94141d1bba12ec825acccd8e3a4dadc4b3e

  • SHA256

    f5be59e959ec4bd757bc798b6a719ae1c7435810136acc05f10bd2f75c36773d

  • SHA512

    93629a3ec23390edf20234acce1ac5095322e73a5bea9f9ea296e5d13c60cd48e42bb24af75b65b3187547db894312055f52e1118e3050ad0cfb4f48fb451339

  • SSDEEP

    12288:m2+R18uUHbyXCljgVDtEqQd2lbRU601zmV2v0osh/keieoGY8GpTyv1M32MfE:n+R+ACSV2qQdilU6lbkzeNY8ky+3e

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      6008b7dbdb784a44d3e37e5609b322ae_JaffaCakes118

    • Size

      740KB

    • MD5

      6008b7dbdb784a44d3e37e5609b322ae

    • SHA1

      1c7cc94141d1bba12ec825acccd8e3a4dadc4b3e

    • SHA256

      f5be59e959ec4bd757bc798b6a719ae1c7435810136acc05f10bd2f75c36773d

    • SHA512

      93629a3ec23390edf20234acce1ac5095322e73a5bea9f9ea296e5d13c60cd48e42bb24af75b65b3187547db894312055f52e1118e3050ad0cfb4f48fb451339

    • SSDEEP

      12288:m2+R18uUHbyXCljgVDtEqQd2lbRU601zmV2v0osh/keieoGY8GpTyv1M32MfE:n+R+ACSV2qQdilU6lbkzeNY8ky+3e

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks