General

  • Target

    7f594e90f0282baeb4e7ca60f078f4ee_JaffaCakes118

  • Size

    295KB

  • Sample

    241030-qlyd9asphw

  • MD5

    7f594e90f0282baeb4e7ca60f078f4ee

  • SHA1

    3094e140306c48e0942ba9ed55fe5b8f112876ae

  • SHA256

    7d0f06b4c736f5740a16023e4edcd978f664caa64b32a9b1a4406d6a7b2382a8

  • SHA512

    df5b1742dd1f1be5ce8d791c8bd31b46c656c7e3807c8f77bc9d40a34c57381172da0062286e2394b858a852d83ea5ab211b29fe8d5a3240884b52330628b7f4

  • SSDEEP

    6144:ADov6LNM7a7JdbrBnuS5j3UOPHJa99bmtUWS2zx9uTamOrM49oW:XsNM7gdP5uyjrcUtQYTuTag49Z

Malware Config

Targets

    • Target

      7f594e90f0282baeb4e7ca60f078f4ee_JaffaCakes118

    • Size

      295KB

    • MD5

      7f594e90f0282baeb4e7ca60f078f4ee

    • SHA1

      3094e140306c48e0942ba9ed55fe5b8f112876ae

    • SHA256

      7d0f06b4c736f5740a16023e4edcd978f664caa64b32a9b1a4406d6a7b2382a8

    • SHA512

      df5b1742dd1f1be5ce8d791c8bd31b46c656c7e3807c8f77bc9d40a34c57381172da0062286e2394b858a852d83ea5ab211b29fe8d5a3240884b52330628b7f4

    • SSDEEP

      6144:ADov6LNM7a7JdbrBnuS5j3UOPHJa99bmtUWS2zx9uTamOrM49oW:XsNM7gdP5uyjrcUtQYTuTag49Z

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax family

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks