Overview

overview

10

Static

static

3

9e24bb0830...18.exe

windows7-x64

10

9e24bb0830...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e24bb0830a5afedf7350959af20b85a_JaffaCakes118

  • Size

    316KB

  • Sample

    241125-1yrscaymcs

  • MD5

    9e24bb0830a5afedf7350959af20b85a

  • SHA1

    3072456abdaee78c39647402499bcbe8f5832394

  • SHA256

    fc4138090c020336d38c62f903c2e3a9ffcf01d5005ed859a59c1d4e08ad9af5

  • SHA512

    60cd220e29f7b3957e6b165e2182c60aeff709ee4dc0817d8b3e0283cf755640d79d8df21a04ebfcd14c6826f9be4d44eb9c686ec8189a657f442c1c182ce06a

  • SSDEEP

    6144:PMZguIwxWbzhAcWsw7phq3nANrkJGcTb9o81wb1RhXxTbHohu:PabQzh9Xwfq3ANrOhoFb1RhXlAu

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      9e24bb0830a5afedf7350959af20b85a_JaffaCakes118

    • Size

      316KB

    • MD5

      9e24bb0830a5afedf7350959af20b85a

    • SHA1

      3072456abdaee78c39647402499bcbe8f5832394

    • SHA256

      fc4138090c020336d38c62f903c2e3a9ffcf01d5005ed859a59c1d4e08ad9af5

    • SHA512

      60cd220e29f7b3957e6b165e2182c60aeff709ee4dc0817d8b3e0283cf755640d79d8df21a04ebfcd14c6826f9be4d44eb9c686ec8189a657f442c1c182ce06a

    • SSDEEP

      6144:PMZguIwxWbzhAcWsw7phq3nANrkJGcTb9o81wb1RhXxTbHohu:PabQzh9Xwfq3ANrOhoFb1RhXlAu

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks