Overview

overview

10

Static

static

3

7897b657b5...18.exe

windows7-x64

10

7897b657b5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7897b657b549d7bece1f4eba26529a5d_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241028-j4l1lssjaq

  • MD5

    7897b657b549d7bece1f4eba26529a5d

  • SHA1

    6e3b8704af7560254e5c9dafb88c20e6f372f5ed

  • SHA256

    ee59f1c354acb7693b6084a65a3f5bd955f2d22a8c15318671bd5d2e5eb390dc

  • SHA512

    ca8a65e30c48b250be7a2f6062650fbbfacf4869cb36617e26ca0f8b353ea0f65b8c557e1600f92fc169e67ce68c57d60b49d32bd11bbfad61ebd9034a2923b4

  • SSDEEP

    24576:grHRqUW1BYrRh4jd3e1B/EYCfGMuAflTn7Lzrws4p4TFk/GiVWWd5kSOW:grHRfW1BYw3e1B/Xg/uAflTnLrwsywmb

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      7897b657b549d7bece1f4eba26529a5d_JaffaCakes118

    • Size

      1.3MB

    • MD5

      7897b657b549d7bece1f4eba26529a5d

    • SHA1

      6e3b8704af7560254e5c9dafb88c20e6f372f5ed

    • SHA256

      ee59f1c354acb7693b6084a65a3f5bd955f2d22a8c15318671bd5d2e5eb390dc

    • SHA512

      ca8a65e30c48b250be7a2f6062650fbbfacf4869cb36617e26ca0f8b353ea0f65b8c557e1600f92fc169e67ce68c57d60b49d32bd11bbfad61ebd9034a2923b4

    • SSDEEP

      24576:grHRqUW1BYrRh4jd3e1B/EYCfGMuAflTn7Lzrws4p4TFk/GiVWWd5kSOW:grHRfW1BYw3e1B/Xg/uAflTnLrwsywmb

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks