Overview

overview

10

Static

static

3

JaffaCakes...68.exe

windows7-x64

10

JaffaCakes...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_34030fcd6c081bb12f6779a5a11e7368

  • Size

    1.0MB

  • Sample

    250114-c63mtatrhz

  • MD5

    34030fcd6c081bb12f6779a5a11e7368

  • SHA1

    997f0c629faae63427f3f1c78cb831134f900e87

  • SHA256

    4e96466076d3626c9bd1faaff368a24287ce4ead7fed2a5ede87ee0e49028aab

  • SHA512

    745893e82147a4738afc28995db5f79920f647d0d8233e21f0da23aa98eece07e4a16f0da02c416e4fc6a48b4305495bf73d2d4e7cfe21e98e2004e14ca44d28

  • SSDEEP

    24576:kAN4rD8ezn6MZFLIGu/APtcHffiwjcf0aqxYG/1W:kAN4rD8ezn6MZ5IGPPtEi2hxYG4

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_34030fcd6c081bb12f6779a5a11e7368

    • Size

      1.0MB

    • MD5

      34030fcd6c081bb12f6779a5a11e7368

    • SHA1

      997f0c629faae63427f3f1c78cb831134f900e87

    • SHA256

      4e96466076d3626c9bd1faaff368a24287ce4ead7fed2a5ede87ee0e49028aab

    • SHA512

      745893e82147a4738afc28995db5f79920f647d0d8233e21f0da23aa98eece07e4a16f0da02c416e4fc6a48b4305495bf73d2d4e7cfe21e98e2004e14ca44d28

    • SSDEEP

      24576:kAN4rD8ezn6MZFLIGu/APtcHffiwjcf0aqxYG/1W:kAN4rD8ezn6MZ5IGPPtEi2hxYG4

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks