Overview

overview

10

Static

static

7

8a582f6a81...18.exe

windows7-x64

10

8a582f6a81...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a582f6a81de74f166b0070e11e0ec1a_JaffaCakes118

  • Size

    1.5MB

  • Sample

    241103-jkahga1qfq

  • MD5

    8a582f6a81de74f166b0070e11e0ec1a

  • SHA1

    780b99bc8362a39826a5834f1ff28a3c0c7357e7

  • SHA256

    19c742eac1d75c5596c3daddace009214bb400bd0369eb934affa044159068f0

  • SHA512

    f7bb8fc3507615f562258daf9caeb9e9f99e8645e8d1e9c5264b7d7f964866fc827a13e7f62248a6ca8c2c3f220c9a5512974238b68efbc292844006936b58c1

  • SSDEEP

    24576:RkJz3kDERA/xwzKoC5A5mjkHh6knDU9YwCuXfZV4UMVAGTyusRMQCqb:2Jz3kT6zm5JjkB/KYwCu/4UMVAGTyusE

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealerthemida

Malware Config

Targets

    • Target

      8a582f6a81de74f166b0070e11e0ec1a_JaffaCakes118

    • Size

      1.5MB

    • MD5

      8a582f6a81de74f166b0070e11e0ec1a

    • SHA1

      780b99bc8362a39826a5834f1ff28a3c0c7357e7

    • SHA256

      19c742eac1d75c5596c3daddace009214bb400bd0369eb934affa044159068f0

    • SHA512

      f7bb8fc3507615f562258daf9caeb9e9f99e8645e8d1e9c5264b7d7f964866fc827a13e7f62248a6ca8c2c3f220c9a5512974238b68efbc292844006936b58c1

    • SSDEEP

      24576:RkJz3kDERA/xwzKoC5A5mjkHh6knDU9YwCuXfZV4UMVAGTyusRMQCqb:2Jz3kT6zm5JjkB/KYwCu/4UMVAGTyusE

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealerthemida

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks