Overview

overview

10

Static

static

3

JaffaCakes...a6.exe

windows7-x64

10

JaffaCakes...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_233d3c6eec63d6b7c607be52c79b64a6

  • Size

    1.3MB

  • Sample

    250124-ts1dzawrd1

  • MD5

    233d3c6eec63d6b7c607be52c79b64a6

  • SHA1

    b4b15abda18cc0a25d4d9604c0f512fb26e6ce34

  • SHA256

    e3d5f96aefd2d6b0d6f0f6e3059cfdcc4f2d6c0657c5a0f8038dfe31745ce45f

  • SHA512

    b3697d6bb2dd57ae4ccf1884d91fef50930cf4e1b3b761d1231465e429db3ef06d6d03e761d7483c74cf8ed8a70e6cf92ba4e454f0797f8a105f1ac6cfa08ffa

  • SSDEEP

    24576:yozmsDi6uGJgjLG3P/bJU7qDPGFOPhqS+7ZPan2Qwr9mJ7Cvrf5Aq4:lptdgfMXbJdDPqS+M/wr9mZYr5Ax

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_233d3c6eec63d6b7c607be52c79b64a6

    • Size

      1.3MB

    • MD5

      233d3c6eec63d6b7c607be52c79b64a6

    • SHA1

      b4b15abda18cc0a25d4d9604c0f512fb26e6ce34

    • SHA256

      e3d5f96aefd2d6b0d6f0f6e3059cfdcc4f2d6c0657c5a0f8038dfe31745ce45f

    • SHA512

      b3697d6bb2dd57ae4ccf1884d91fef50930cf4e1b3b761d1231465e429db3ef06d6d03e761d7483c74cf8ed8a70e6cf92ba4e454f0797f8a105f1ac6cfa08ffa

    • SSDEEP

      24576:yozmsDi6uGJgjLG3P/bJU7qDPGFOPhqS+7ZPan2Qwr9mJ7Cvrf5Aq4:lptdgfMXbJdDPqS+M/wr9mZYr5Ax

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks