General
-
Target
f741ddd90dcd1d14e0399c2582857bba_JaffaCakes118
-
Size
2.8MB
-
Sample
241216-ev8qssvphq
-
MD5
f741ddd90dcd1d14e0399c2582857bba
-
SHA1
bec3e9d783a591d1667e8c060868161f3a700ca5
-
SHA256
bddf3f8d7e3246c0eccc53bc2af57ecce1a089bfbb0d4184abbb2153c2794447
-
SHA512
f6f5bb14b550da884f10e78226c1cf42957e17fbd0bd2f5f7bbed1f76ee8b621ebc942265c0e0cba163f58d9b9861a18b7d32b80fba5f700d19ad8e393b4fa56
-
SSDEEP
49152:7GrT6Aj+7Jk6628y+7kBOTOBaWO9fwQr9UPGHWjkerWuFAijtXiS1Wxr:7xAj4/H/+w4T+amQBU+HWjk6XFvpXi1d
Malware Config
Targets
-
-
Target
f741ddd90dcd1d14e0399c2582857bba_JaffaCakes118
-
Size
2.8MB
-
MD5
f741ddd90dcd1d14e0399c2582857bba
-
SHA1
bec3e9d783a591d1667e8c060868161f3a700ca5
-
SHA256
bddf3f8d7e3246c0eccc53bc2af57ecce1a089bfbb0d4184abbb2153c2794447
-
SHA512
f6f5bb14b550da884f10e78226c1cf42957e17fbd0bd2f5f7bbed1f76ee8b621ebc942265c0e0cba163f58d9b9861a18b7d32b80fba5f700d19ad8e393b4fa56
-
SSDEEP
49152:7GrT6Aj+7Jk6628y+7kBOTOBaWO9fwQr9UPGHWjkerWuFAijtXiS1Wxr:7xAj4/H/+w4T+amQBU+HWjk6XFvpXi1d
Score10/10-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-