Overview

overview

10

Static

static

3

cc3e2de7d8...18.exe

windows7-x64

10

cc3e2de7d8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc3e2de7d845f88c9ab555d83e08447f_JaffaCakes118

  • Size

    478KB

  • Sample

    241206-lcj32szrct

  • MD5

    cc3e2de7d845f88c9ab555d83e08447f

  • SHA1

    7c3c5dbc1af107fc49d12167236d53034794532b

  • SHA256

    74a40d435577c42fb797e8e69a7f05cbd80392bf3e2ef02adc7ece271a3c08de

  • SHA512

    9469254918594d4b544a608f321b21017d1df1a07630eb70c19efcc93e111e7f22e1f5f7bac86d96f34a594f45eb8b1c31cdefad38157a3522d6e1b24326bc2b

  • SSDEEP

    12288:fLL6kSm3hmglja7RjlRi2BdYCwAaaDP8NM/GQ+9RBqg:669M7RxRiQHaaT/G3jBqg

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      cc3e2de7d845f88c9ab555d83e08447f_JaffaCakes118

    • Size

      478KB

    • MD5

      cc3e2de7d845f88c9ab555d83e08447f

    • SHA1

      7c3c5dbc1af107fc49d12167236d53034794532b

    • SHA256

      74a40d435577c42fb797e8e69a7f05cbd80392bf3e2ef02adc7ece271a3c08de

    • SHA512

      9469254918594d4b544a608f321b21017d1df1a07630eb70c19efcc93e111e7f22e1f5f7bac86d96f34a594f45eb8b1c31cdefad38157a3522d6e1b24326bc2b

    • SSDEEP

      12288:fLL6kSm3hmglja7RjlRi2BdYCwAaaDP8NM/GQ+9RBqg:669M7RxRiQHaaT/G3jBqg

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks