Overview

overview

10

Static

static

3

JaffaCakes...0b.exe

windows7-x64

10

JaffaCakes...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_cc1644ec5ead390052f977054f42990b

  • Size

    1.2MB

  • Sample

    250119-tb6jnavpem

  • MD5

    cc1644ec5ead390052f977054f42990b

  • SHA1

    ddf8f71466533b2a6765fcbe04e6690f470b86a8

  • SHA256

    2b2556ab9e99e5ba8c2ab5118935887f67bbf336225fa7ffbdbee008917b611c

  • SHA512

    17a652f43bd8e256de49014dee727a33f857b135d9581840b5e993409aa3c2bce891f640acfd373cabddd3544603561671cc01a65c42feafd53824f559f43490

  • SSDEEP

    24576:/U4oTv8la+1fIeQZJ3nrBBtKRWBbfMHeRlWZ6zSoosHYImQCaQ:/ULTvmIeWTKcbSoDzboS56a

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_cc1644ec5ead390052f977054f42990b

    • Size

      1.2MB

    • MD5

      cc1644ec5ead390052f977054f42990b

    • SHA1

      ddf8f71466533b2a6765fcbe04e6690f470b86a8

    • SHA256

      2b2556ab9e99e5ba8c2ab5118935887f67bbf336225fa7ffbdbee008917b611c

    • SHA512

      17a652f43bd8e256de49014dee727a33f857b135d9581840b5e993409aa3c2bce891f640acfd373cabddd3544603561671cc01a65c42feafd53824f559f43490

    • SSDEEP

      24576:/U4oTv8la+1fIeQZJ3nrBBtKRWBbfMHeRlWZ6zSoosHYImQCaQ:/ULTvmIeWTKcbSoDzboS56a

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks