Overview

overview

10

Static

static

3

69d723338b...18.exe

windows7-x64

10

69d723338b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69d723338b992ee153027b1b159d9ec1_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241022-k9zpbsxfre

  • MD5

    69d723338b992ee153027b1b159d9ec1

  • SHA1

    febc1a6fdb5b81e73f15a68f4bee2b3e058e65a5

  • SHA256

    1e48e0a89ad24b9273a92b3bb707e07ecf0635b609f14768e59c8ca9249c5a70

  • SHA512

    1089c03af40963a23a79bf3d4711b96d5ac94e84f8db59a522f3efe7b689266af6b4cab6815f9bdeebb35778b90d76e9d41f5fc76010e7f76e69e2ad354f0681

  • SSDEEP

    24576:elTV5nFNJ4fmEST3LfeS5I8t/bY+I1ynqvB/L6tt1R8oc+I1C1+v5ZR69tFRva:edzzpDLV5i+8ynpt18+8C1ntFY

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      69d723338b992ee153027b1b159d9ec1_JaffaCakes118

    • Size

      1.3MB

    • MD5

      69d723338b992ee153027b1b159d9ec1

    • SHA1

      febc1a6fdb5b81e73f15a68f4bee2b3e058e65a5

    • SHA256

      1e48e0a89ad24b9273a92b3bb707e07ecf0635b609f14768e59c8ca9249c5a70

    • SHA512

      1089c03af40963a23a79bf3d4711b96d5ac94e84f8db59a522f3efe7b689266af6b4cab6815f9bdeebb35778b90d76e9d41f5fc76010e7f76e69e2ad354f0681

    • SSDEEP

      24576:elTV5nFNJ4fmEST3LfeS5I8t/bY+I1ynqvB/L6tt1R8oc+I1C1+v5ZR69tFRva:edzzpDLV5i+8ynpt18+8C1ntFY

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks