Extracted

• • Target

    b69c254bc42a14b5193b4c0902977649_JaffaCakes118

  • Size

    580KB

  • MD5

    b69c254bc42a14b5193b4c0902977649

  • SHA1

    aca77f932ac60d946e6d1d9db7ef4635bada68d9

  • SHA256

    e5603248ccffa18a34180211e5c36ab6c2746e23b1f430632d68973a8c5c2a3f

  • SHA512

    98d565e2d847bb6f4db89f13ed4f54d04d9f1c55fba668afd780f72e4c7a7c9665b3dad7d55ba5e166539146db9953b030676687f9a8a79af03bdc1a6bdd63dc

  • SSDEEP

    12288:CG3z0SWs3mu0GJgYtd+LwT95/+gD9bjOmDJQ4CkCBpZCAXRgxCfPmV2Hx:rj9WwuGJgY7+LwT91+gBOm9QZtpsNlox

  Score

  10^/10

  discoveryardamaxsalitybackdoorevasionkeyloggerpersistenceprivilege_escalationstealertrojanupx

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax family

    ardamax

  • Ardamax main executable

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2