Overview

overview

10

Static

static

3

COLLEC~1.exe

windows7-x64

10

COLLEC~1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0ef25920e3aa89d7e48625410332227_JaffaCakes118

  • Size

    471KB

  • Sample

    241204-fpscassrgw

  • MD5

    c0ef25920e3aa89d7e48625410332227

  • SHA1

    05279f26af739a02fa67115043d6f374365cde1a

  • SHA256

    bb20456bf083fcb22223e7864a80b8a9e0520c3b20b07b0a0b84406a9a638566

  • SHA512

    c223dde80e28c9969471161a40e3b79fc99784772e055a9b1f9a5b48b64f02486d10b55aa271f7d54073ce53259671465f7b0409a85efbe1a242c19fc4690c6e

  • SSDEEP

    12288:RVQ52d0EUjDORfE+hPtbT1X//GwTAYlzV8/bzR:RVQ520E4mfEcFGxYlwh

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      COLLEC~1.EXE

    • Size

      478KB

    • MD5

      2847e352f486964aedee974de1475558

    • SHA1

      db30e59f1e58404563c368cbfd5c76b7f14fdf36

    • SHA256

      2a8ce05432d7e10bad747d593548e62a2d2fe03ce97c02d302eefde6c046d43d

    • SHA512

      e1a933d74c4e178cb3bee0a9b1601bde675ff7038d12738507074a8f2fee4bb632e90180b7b2bee55111d3f06159fadfac68e79c4f547a73f9406dbbaf143b06

    • SSDEEP

      12288:RSvVQ53d2OFjDOtOE+1Ftbi1XB/SwXAjpuV8/bQ/:gVQ5N2OVyOEyGo5jpTa

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks