Overview

overview

10

Static

static

10

f354530a49...18.exe

windows7-x64

10

f354530a49...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f354530a499a1fa8bd988253e16f3f1d_JaffaCakes118

  • Size

    328KB

  • Sample

    241215-lag6ns1qej

  • MD5

    f354530a499a1fa8bd988253e16f3f1d

  • SHA1

    ac99cbb7ddcc51c3a05d83b8a6a29d8dd83283b5

  • SHA256

    ed32c74397f0db5108f589fd0c253bdc9a8f0e30a86cb4c868e45b9ebc5d65ac

  • SHA512

    c4bfe9eb4da20cf0bbf9e949e584ecd54bc3dcd90a557ba678f3cbef6282955fb88836ced64cf4886e184d8712aa2d3299e0a2faf8d314b2d730d98a7cc48d71

  • SSDEEP

    6144:hjCDcp+tffoycg8bQoRhYTXnyO3Qz/2yczRmzDO:VCDPFCp8z/3Q/lrzC

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      f354530a499a1fa8bd988253e16f3f1d_JaffaCakes118

    • Size

      328KB

    • MD5

      f354530a499a1fa8bd988253e16f3f1d

    • SHA1

      ac99cbb7ddcc51c3a05d83b8a6a29d8dd83283b5

    • SHA256

      ed32c74397f0db5108f589fd0c253bdc9a8f0e30a86cb4c868e45b9ebc5d65ac

    • SHA512

      c4bfe9eb4da20cf0bbf9e949e584ecd54bc3dcd90a557ba678f3cbef6282955fb88836ced64cf4886e184d8712aa2d3299e0a2faf8d314b2d730d98a7cc48d71

    • SSDEEP

      6144:hjCDcp+tffoycg8bQoRhYTXnyO3Qz/2yczRmzDO:VCDPFCp8z/3Q/lrzC

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks