General

  • Target

    7b30cb90f9435924fad4be213e20c7a8_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241029-ahawsa1ckl

  • MD5

    7b30cb90f9435924fad4be213e20c7a8

  • SHA1

    b398c5c2698e7b8b90270c4387c403e0301b79e5

  • SHA256

    cf9fc30734a66301243ec24254ccf8dbb6e14a4a7810c88c70d213f3e3fedcf3

  • SHA512

    7f7db748cae3642ee7696c1716b3b77c745f03f7b2cc94e00476ff7b032d17b9f634c18a2c8328853d043f9ae4d1b2b2ab7cb5666b263c545d92024ec41ddf02

  • SSDEEP

    24576:zH0KuT8PEEv/RVKyr4XFB7uHG6yGzazgiyFLEzyL/Z1TAniQbqxf:zH0RT8MqRVKU41BaviytrZmW

Malware Config

Targets

    • Target

      7b30cb90f9435924fad4be213e20c7a8_JaffaCakes118

    • Size

      1.2MB

    • MD5

      7b30cb90f9435924fad4be213e20c7a8

    • SHA1

      b398c5c2698e7b8b90270c4387c403e0301b79e5

    • SHA256

      cf9fc30734a66301243ec24254ccf8dbb6e14a4a7810c88c70d213f3e3fedcf3

    • SHA512

      7f7db748cae3642ee7696c1716b3b77c745f03f7b2cc94e00476ff7b032d17b9f634c18a2c8328853d043f9ae4d1b2b2ab7cb5666b263c545d92024ec41ddf02

    • SSDEEP

      24576:zH0KuT8PEEv/RVKyr4XFB7uHG6yGzazgiyFLEzyL/Z1TAniQbqxf:zH0RT8MqRVKU41BaviytrZmW

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax family

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks