Overview

overview

10

Static

static

3

6d35a9f9cd...18.exe

windows7-x64

10

6d35a9f9cd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d35a9f9cdea71d2603caad084fde335_JaffaCakes118

  • Size

    256KB

  • Sample

    241023-fms6tatfmp

  • MD5

    6d35a9f9cdea71d2603caad084fde335

  • SHA1

    ad36e19921b3e0b702578c2ce13dd59c0945e7e6

  • SHA256

    d2e763292ef4a13882824d3f509f8dd643ed9c9664f4ee08ebf5fb0885a9cece

  • SHA512

    558ff342f81f7929a7e380ddd5d0c7ee5423917578baa17d0b870c9e1b802afadd5c8c3195f27a1200920d366e1061f1b71f9178ecfcbb567cdd516ccf74b555

  • SSDEEP

    6144:J9n5ssybeB1lbjN2t3/hd840jtkXMxoiRpWA9:JJ5/y8js590jFRIA9

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      6d35a9f9cdea71d2603caad084fde335_JaffaCakes118

    • Size

      256KB

    • MD5

      6d35a9f9cdea71d2603caad084fde335

    • SHA1

      ad36e19921b3e0b702578c2ce13dd59c0945e7e6

    • SHA256

      d2e763292ef4a13882824d3f509f8dd643ed9c9664f4ee08ebf5fb0885a9cece

    • SHA512

      558ff342f81f7929a7e380ddd5d0c7ee5423917578baa17d0b870c9e1b802afadd5c8c3195f27a1200920d366e1061f1b71f9178ecfcbb567cdd516ccf74b555

    • SSDEEP

      6144:J9n5ssybeB1lbjN2t3/hd840jtkXMxoiRpWA9:JJ5/y8js590jFRIA9

    Score
    10/10
    ardamaxdiscoverykeyloggerstealerpersistence

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks