Overview

overview

10

Static

static

3

JaffaCakes...3c.exe

windows7-x64

10

JaffaCakes...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8de700e8746be050d138560544d64a3c

  • Size

    961KB

  • Sample

    250117-rertka1pgr

  • MD5

    8de700e8746be050d138560544d64a3c

  • SHA1

    014b1e8d2f4e6ef2a7cd1bd3f64cf09c2acdd269

  • SHA256

    1367a4958018d39baa8b1857da73480373e1404d6b3dd07675563ef17292de44

  • SHA512

    b2c2e5004cac455de2ff80b790688c1b3f7e5ff26768244310aac14e7c70de3cf107d20b31f330a55ef40e45ec5b7247e3e4f20e4571aea5e9ce928c0e7b7314

  • SSDEEP

    24576:y64MVTfAAtwsgbwbU/ph8hjPJXcOHYl7HMkxEsxU4Z0bF5sFwY2:y64MToAtws4wSp8jPJMOHE7HJBoF2wY

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_8de700e8746be050d138560544d64a3c

    • Size

      961KB

    • MD5

      8de700e8746be050d138560544d64a3c

    • SHA1

      014b1e8d2f4e6ef2a7cd1bd3f64cf09c2acdd269

    • SHA256

      1367a4958018d39baa8b1857da73480373e1404d6b3dd07675563ef17292de44

    • SHA512

      b2c2e5004cac455de2ff80b790688c1b3f7e5ff26768244310aac14e7c70de3cf107d20b31f330a55ef40e45ec5b7247e3e4f20e4571aea5e9ce928c0e7b7314

    • SSDEEP

      24576:y64MVTfAAtwsgbwbU/ph8hjPJXcOHYl7HMkxEsxU4Z0bF5sFwY2:y64MToAtws4wSp8jPJMOHE7HJBoF2wY

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks