Overview

overview

10

Static

static

3

7771138bc9...18.exe

windows7-x64

10

7771138bc9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7771138bc9285f86a94bdce1d8971b0d_JaffaCakes118

  • Size

    1.8MB

  • Sample

    241028-d1m6lsxjdl

  • MD5

    7771138bc9285f86a94bdce1d8971b0d

  • SHA1

    6565ccc177f068c578866608061c607dd4de0184

  • SHA256

    155589ead63418556f73500f533625ba485e713c850141503e13bb986daa558f

  • SHA512

    727e9e279851dca7bdd4910e0096b0f24558a38dd2863c7293acef1a5bb9779ac66fe817b08a564b9a93a1b612f1a7aba8d45876a3f200d5e77408755b6fff97

  • SSDEEP

    49152:iDlgqip4B4bJF3ZdgNz+xDlgqip4B4bJF3ZdgNz+t:XpPX3+ppPX3+0

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      7771138bc9285f86a94bdce1d8971b0d_JaffaCakes118

    • Size

      1.8MB

    • MD5

      7771138bc9285f86a94bdce1d8971b0d

    • SHA1

      6565ccc177f068c578866608061c607dd4de0184

    • SHA256

      155589ead63418556f73500f533625ba485e713c850141503e13bb986daa558f

    • SHA512

      727e9e279851dca7bdd4910e0096b0f24558a38dd2863c7293acef1a5bb9779ac66fe817b08a564b9a93a1b612f1a7aba8d45876a3f200d5e77408755b6fff97

    • SSDEEP

      49152:iDlgqip4B4bJF3ZdgNz+xDlgqip4B4bJF3ZdgNz+t:XpPX3+ppPX3+0

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks