Overview

overview

10

Static

static

3

79fff9307d...18.exe

windows7-x64

10

79fff9307d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79fff9307d2080c9af29ca8d28f7ec47_JaffaCakes118

  • Size

    606KB

  • Sample

    241028-rh7n7aypft

  • MD5

    79fff9307d2080c9af29ca8d28f7ec47

  • SHA1

    bb9fe640102bd3eba7956073180d7ff16e8755cf

  • SHA256

    e36d1b390e6fd37dfa4dd0bab62322eba92b98a4d1be41e1918c91d5f6250dec

  • SHA512

    a5c0808ccb685cc8342129249461e6dfb97b23ec4e6464c0d71c3529fabaca812fcc64f5de829aad8e2b5a7b50628c68fc61e358e7c0ccd5b22aac712814408e

  • SSDEEP

    12288:whaCEJNB7YpOgynhbTU3eS9B6gDpdImyxR5LmTofnP5BVENGWAKe:wwCINBMph4hnUuSfpdC5gofnPxEp+

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealerupx

Malware Config

Targets

    • Target

      79fff9307d2080c9af29ca8d28f7ec47_JaffaCakes118

    • Size

      606KB

    • MD5

      79fff9307d2080c9af29ca8d28f7ec47

    • SHA1

      bb9fe640102bd3eba7956073180d7ff16e8755cf

    • SHA256

      e36d1b390e6fd37dfa4dd0bab62322eba92b98a4d1be41e1918c91d5f6250dec

    • SHA512

      a5c0808ccb685cc8342129249461e6dfb97b23ec4e6464c0d71c3529fabaca812fcc64f5de829aad8e2b5a7b50628c68fc61e358e7c0ccd5b22aac712814408e

    • SSDEEP

      12288:whaCEJNB7YpOgynhbTU3eS9B6gDpdImyxR5LmTofnP5BVENGWAKe:wwCINBMph4hnUuSfpdC5gofnPxEp+

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealerupx

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks