Overview

overview

10

Static

static

3

68f88bc3ea...18.exe

windows7-x64

10

68f88bc3ea...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68f88bc3ea27c74d26d915cca8ebb0af_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241022-feq2gsybkf

  • MD5

    68f88bc3ea27c74d26d915cca8ebb0af

  • SHA1

    5f856d7c74a8ee446458fb1dbaaaedd0d90161d5

  • SHA256

    b70c63bc75411c9b3d7cb4babca8cd70a9d518549c60b2851aa603447ca5dfaf

  • SHA512

    bfe2cf47842658ac64610c130dcc7483ea01abb94c8c7e26c0f5533dd61120656f87815bff9d1af34a03b9490e74df6e7f32547b4ff6505fbda8739a3dd742b3

  • SSDEEP

    24576:3ZxTkEZrs914LVN4gbcqzOVPz4ztaJjuOcSwTBSIPufJbM0yiBiXPPVk:3XT7s914LIgbXOFz4zo1xKPufJwt2w3V

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      68f88bc3ea27c74d26d915cca8ebb0af_JaffaCakes118

    • Size

      1.1MB

    • MD5

      68f88bc3ea27c74d26d915cca8ebb0af

    • SHA1

      5f856d7c74a8ee446458fb1dbaaaedd0d90161d5

    • SHA256

      b70c63bc75411c9b3d7cb4babca8cd70a9d518549c60b2851aa603447ca5dfaf

    • SHA512

      bfe2cf47842658ac64610c130dcc7483ea01abb94c8c7e26c0f5533dd61120656f87815bff9d1af34a03b9490e74df6e7f32547b4ff6505fbda8739a3dd742b3

    • SSDEEP

      24576:3ZxTkEZrs914LVN4gbcqzOVPz4ztaJjuOcSwTBSIPufJbM0yiBiXPPVk:3XT7s914LIgbXOFz4zo1xKPufJwt2w3V

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks