Overview

overview

10

Static

static

3

62b49060fe...18.exe

windows7-x64

7

62b49060fe...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62b49060fec089977f2b765de5c01c95_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241020-rr18rsvcqm

  • MD5

    62b49060fec089977f2b765de5c01c95

  • SHA1

    73f5831615236f1657d50c1deacb2fff938a3170

  • SHA256

    a60bb5639ce74b653dd63a979ba79af58b139cc51531038c24d30626fb0477e4

  • SHA512

    25318b648a37fca44446574ce264b3d74338cad2e6b7d35d24287c89e6403999018b920f5d65616b779606b92b44084bbac49bb29ae5b4ab85f24c1ac9ab9290

  • SSDEEP

    24576:uHVK/PmqiEGSQy/guUWg71mHc3zQWKI3/XdaxvBHle0ak4rU0g+Of5z3E:uIiEGHV7HYnccE

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      62b49060fec089977f2b765de5c01c95_JaffaCakes118

    • Size

      1.3MB

    • MD5

      62b49060fec089977f2b765de5c01c95

    • SHA1

      73f5831615236f1657d50c1deacb2fff938a3170

    • SHA256

      a60bb5639ce74b653dd63a979ba79af58b139cc51531038c24d30626fb0477e4

    • SHA512

      25318b648a37fca44446574ce264b3d74338cad2e6b7d35d24287c89e6403999018b920f5d65616b779606b92b44084bbac49bb29ae5b4ab85f24c1ac9ab9290

    • SSDEEP

      24576:uHVK/PmqiEGSQy/guUWg71mHc3zQWKI3/XdaxvBHle0ak4rU0g+Of5z3E:uIiEGHV7HYnccE

    Score
    10/10
    discoverypersistenceardamaxkeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks