Overview

overview

10

Static

static

3

JaffaCakes...50.exe

windows7-x64

10

JaffaCakes...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_77116079433069a1c0d7250c77725a50

  • Size

    271KB

  • Sample

    250104-cw2b1awpgw

  • MD5

    77116079433069a1c0d7250c77725a50

  • SHA1

    90a33736c08f5647057836b6b284f01a07ed7a29

  • SHA256

    8eedf6c3ea41c461e5897243177b4fa4807657649621730b7f58c65c6bdf311d

  • SHA512

    517094a29ccb96f6863ceeb2812768d7aa4d91011e58238c90f3d3618ebc887341421ced9e485e9d27f7ee1bfbe129ae0ea539a0a7dc963ddbbf949324cd0730

  • SSDEEP

    3072:NC4G686fJchLGKn5ebseFdbRyUS+ojeyQe+qP11oj17NEhYkiNw5t8OxY3yPjJUo:LG65fJchqKAbBRg0cUm+Nw5t8KLPjcC

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_77116079433069a1c0d7250c77725a50

    • Size

      271KB

    • MD5

      77116079433069a1c0d7250c77725a50

    • SHA1

      90a33736c08f5647057836b6b284f01a07ed7a29

    • SHA256

      8eedf6c3ea41c461e5897243177b4fa4807657649621730b7f58c65c6bdf311d

    • SHA512

      517094a29ccb96f6863ceeb2812768d7aa4d91011e58238c90f3d3618ebc887341421ced9e485e9d27f7ee1bfbe129ae0ea539a0a7dc963ddbbf949324cd0730

    • SSDEEP

      3072:NC4G686fJchLGKn5ebseFdbRyUS+ojeyQe+qP11oj17NEhYkiNw5t8OxY3yPjJUo:LG65fJchqKAbBRg0cUm+Nw5t8KLPjcC

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks