Overview

overview

10

Static

static

3

8f4fc18b5c...18.exe

windows7-x64

10

8f4fc18b5c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118

  • Size

    501KB

  • Sample

    241104-fs6dbstmav

  • MD5

    8f4fc18b5ce85b6ca3264f1d49d25188

  • SHA1

    c0bb74fc54d25571bb3ce8aa78c0619e52c7e8ff

  • SHA256

    a40516d2794c5e86d2840903089d202b584b8199ecfaf8f9a8cd37582038ef1e

  • SHA512

    b3bc2d9e95328d7405f5f13885d230025c1b5031beab42ccb7bc05aacc31d7183eb50679b45a4c385db4b5172a8d09c353f554f07b1df4a18349520c460a5ee9

  • SSDEEP

    12288:F4h0VSkuBJ/T+MGme5Xz/q2R23s4X0a/p57g:usubT+Mle53H4nG

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118

    • Size

      501KB

    • MD5

      8f4fc18b5ce85b6ca3264f1d49d25188

    • SHA1

      c0bb74fc54d25571bb3ce8aa78c0619e52c7e8ff

    • SHA256

      a40516d2794c5e86d2840903089d202b584b8199ecfaf8f9a8cd37582038ef1e

    • SHA512

      b3bc2d9e95328d7405f5f13885d230025c1b5031beab42ccb7bc05aacc31d7183eb50679b45a4c385db4b5172a8d09c353f554f07b1df4a18349520c460a5ee9

    • SSDEEP

      12288:F4h0VSkuBJ/T+MGme5Xz/q2R23s4X0a/p57g:usubT+Mle53H4nG

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks