Overview

overview

10

Static

static

7

8d3a321593...18.exe

windows7-x64

10

8d3a321593...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8d3a32159364e0bd9b4caca95d17ed1b_JaffaCakes118

  • Size

    1.6MB

  • Sample

    241103-ynna3asjdy

  • MD5

    8d3a32159364e0bd9b4caca95d17ed1b

  • SHA1

    60f8b95bc9476c535b22d10eb1a94393f593a197

  • SHA256

    d7f747164758452f7d573ed768fadb9450361671c33453a99229c27a2db360ea

  • SHA512

    c2028626b9aeea9a6bd4c7bddd77db12063dce73d609c19e54e27d79b2232190e2930357d0b2e697b07a2e71b137322d20bf35a3a129635710a67dadff993670

  • SSDEEP

    49152:TXla1FgP4/vI+uNrwwnUyWyuadT2+3GSSrPkLIPS:TXIr/ONRp2+WSSwL7

Score
10/10
ardamaxdefense_evasiondiscoveryevasionkeyloggerpersistencestealerthemida

Malware Config

Targets

    • Target

      8d3a32159364e0bd9b4caca95d17ed1b_JaffaCakes118

    • Size

      1.6MB

    • MD5

      8d3a32159364e0bd9b4caca95d17ed1b

    • SHA1

      60f8b95bc9476c535b22d10eb1a94393f593a197

    • SHA256

      d7f747164758452f7d573ed768fadb9450361671c33453a99229c27a2db360ea

    • SHA512

      c2028626b9aeea9a6bd4c7bddd77db12063dce73d609c19e54e27d79b2232190e2930357d0b2e697b07a2e71b137322d20bf35a3a129635710a67dadff993670

    • SSDEEP

      49152:TXla1FgP4/vI+uNrwwnUyWyuadT2+3GSSrPkLIPS:TXIr/ONRp2+WSSwL7

    Score
    10/10
    ardamaxdefense_evasiondiscoveryevasionkeyloggerpersistencestealerthemida

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks