Overview

overview

10

Static

static

10

Img.exe

windows7-x64

3

Img.exe

windows10-2004-x64

3

setup_akl.exe

windows7-x64

10

setup_akl.exe

windows10-2004-x64

10

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

AKV.exe

windows7-x64

3

AKV.exe

windows10-2004-x64

3

POL.dll

windows7-x64

3

POL.dll

windows10-2004-x64

3

POL.exe

windows7-x64

6

POL.exe

windows10-2004-x64

6

POL.dll

windows7-x64

3

POL.dll

windows10-2004-x64

3

POL.dll

windows7-x64

3

POL.dll

windows10-2004-x64

3

POL.chm

windows7-x64

1

POL.chm

windows10-2004-x64

1

POL.exe

windows7-x64

6

POL.exe

windows10-2004-x64

6

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

qs.html

windows7-x64

3

qs.html

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_2718628ad3f3b7131b166e8d380d0c6e

  • Size

    949KB

  • Sample

    250125-bzc8xaymhx

  • MD5

    2718628ad3f3b7131b166e8d380d0c6e

  • SHA1

    e298bb18b27abc181d71662afdca1d0239ddf89e

  • SHA256

    6e55caedc91f3465d0594681a1abe6fd3aaffabde64a26eaed1d0e228de59db6

  • SHA512

    5e410af2edb4ffd104e73d4536eae5e3b7a69551cff600aff4b6ce2ec3d0e8a157e496e11fe189c75842362ea3870e2d42f98100e2bdb64ff3085e3e9982e13c

  • SSDEEP

    24576:CscbdH9FSdgp7PGh1I4j+R+NHGuhVWIfsTQ:CHdFHp7PGh1YpuSIkTQ

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      Img.exe

    • Size

      165KB

    • MD5

      0e52e717d573f6e4adeeabf476056195

    • SHA1

      ea2445961c203f2923bbe0064dfa02cfe6f7a131

    • SHA256

      8b23a2a3cbfb4432be1739cdfb0f57b9edc6e3bafe4a113f5122a73fa071d930

    • SHA512

      0fd6a06b69933b543be1d1e8c4c646b092076f4c3ed5583056060f869657d5486e3c56821ea356a2b9405718d596ee0fd5a9ddeda70441617389c646cee16c8f

    • SSDEEP

      3072:zCSmj4klVz1ZHP6irPqhh9wVF4UaRWMYGyjQa1I:+STEVZVFyhU4T4MYdQEI

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      setup_akl.exe

    • Size

      863KB

    • MD5

      eb9e76ce73187384507f076a7892bb79

    • SHA1

      c4dee459ef95b75d3338ef5de17df0f4c031d869

    • SHA256

      3bc1eacc1a9c65d1a876503cf796d93a0bf72acdd7c514db3c017b34b1bb6b43

    • SHA512

      04e9dada33c5324ff942cc82729de1847b0f129f4e690f241db3a5b09ee1d2cc70980a11685052100e3617ad4050a035a433a25dd8f01de553a036c85ae4f403

    • SSDEEP

      12288:JrWLayfJ9fd76616z+qUDbkVWNqoP0ndJbQ1GAC4RUNWCywPcOX5ur:ZofdN1FqF0NXPOJbIGZ4RUN5pur

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      3809b1424d53ccb427c88cabab8b5f94

    • SHA1

      bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

    • SHA256

      426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

    • SHA512

      626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

    • SSDEEP

      192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT7K72dwF7dBdcQOz:i6JaVh4I5rpPbT7+BdhO

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      AKV.exe

    • Size

      457KB

    • MD5

      46ccfd974518e5849738449034a05a17

    • SHA1

      d391108816aed7ba8f7beb205ad7171c74eae6b2

    • SHA256

      571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe

    • SHA512

      773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a

    • SSDEEP

      6144:y3CPF9R/a4bR55krSGKLFLtqWwxSnvAHc/0QR86ll8h/9VGC9HK:l/agR0rSGKBLtPMEvAHL2lr

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      POL.003

    • Size

      4KB

    • MD5

      4b8ed89120fe8ddc31ddba07bc15372b

    • SHA1

      181e7ac3d444656f50c1cd02a6832708253428e6

    • SHA256

      2ae6b0e14465338be0bc5ad10703f5c823d092ebb8cff7e5a05b7d79c8459b93

    • SHA512

      49269b71270b3eda0ddcb399021de9c88f6fd2086cf54fa4898a91e64afe109d44b635d47a5ea9bae7f53a5e968af97fa13bdf699ba00ce879ecadd7bbc8af23

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      POL.004

    • Size

      14KB

    • MD5

      4687a64503f962915cd278baada57449

    • SHA1

      ef42ea6ac10a1eff3b8ccea7194e4bdcaf18f6bb

    • SHA256

      2660a6af939bf1e32391c5ef13afb14ee65a6bd866d4b152e7f5db6747d7a67c

    • SHA512

      0aa67de3ce116f2d0c4f5d43da8aceee4802272feeae5e018e0dc653eb6f609a786e2f40df4e9102ee9f1e199831aaa021fd4c50960d83568eb2f87cb8f0b7f8

    • SSDEEP

      384:Hy7jAinxMexPlOXA5ChIcotxMqEhCa0TUVBKuK:Hy7jAinxLAWC5sfjTUVBKR

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral11behavioral12

    • Target

      POL.006

    • Size

      8KB

    • MD5

      395bbef326fa5ad1216b23f5debf167b

    • SHA1

      aa4a7334b5a693b3f0d6f47b568e0d13a593d782

    • SHA256

      7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1

    • SHA512

      dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679

    • SSDEEP

      192:IVdg5cxPjOhoZHOiX+/yWDpQzWXEM1DOcQs8O+y:Ik5cpOhSuK+/ynMEQfQ3O

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      POL.007

    • Size

      5KB

    • MD5

      1b5e72f0ebd49cf146f9ae68d792ffe5

    • SHA1

      1e90a69c12b9a849fbbac0670296b07331c1cf87

    • SHA256

      8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e

    • SHA512

      6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc

    • SSDEEP

      48:6mn/3+o80EE/KD4XJQK5Gaayko1vmiXdjAECihnm8mMWrlo0P:6m0DMWaavoFRNsECi9mbrlo

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      POL.chm

    • Size

      33KB

    • MD5

      8e4c5c3fee759991597ebc2d855ad4e4

    • SHA1

      b3da123c6300a330b8c869b1ba807115e42c6eab

    • SHA256

      e97a9f0dd54d6013280cbb032e63b9cfcc976886a46eeeac07a45af2fc545547

    • SHA512

      30a126b57b538f3429a66785521ce30e8dfe4e617d84381e9f5a0feae5956576aaf00253ea41170e12813f2637edd11c5ce643c08dd4920bf30d8bf94b95208e

    • SSDEEP

      768:fvRGoivyAZf0pzIQgkz7wbTxEg+KafMbyh7XyONv:fvwTvTZfIz7Sx3yZh7vNv

    Score
    1/10
    behavioral17behavioral18

    • Target

      POL.exe

    • Size

      649KB

    • MD5

      2bff0c75a04401dada0adfab933e46a7

    • SHA1

      364d97f90b137f8e359d998164fb15d474be7bbb

    • SHA256

      2aa53bc5da3294817f95d8806effdf28e5af49661a955256c46db2b67cb6e6da

    • SHA512

      88b82973d3c042bceb75e12297111fa7b8bd4e2a7a37d26b698c595d8d75ec670cc7aebfa2572206c1b2a4ecbbfa3103affb8bee6d7ef47428a225e2cd1bea3f

    • SSDEEP

      12288:z+/bmnuDF7LsmaIZumD5YBZq6xGJOpqtAnWGgAIb3NEnCztPvnK3STFiJ:zMYW/sma25Y+0Gkp0AWG1Imw83OFQ

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20

    • Target

      Uninstall.exe

    • Size

      43KB

    • MD5

      4bbbf32667e8d9aca25b74536c022802

    • SHA1

      128ce5fb0d058cc9126da94a2f9799b2275dfa22

    • SHA256

      df3a520beb7b22566981849512cfba209d108d65505b49f38ad054aad9940c17

    • SHA512

      5a850f7d6ef5293aba4594370eb59116d78b31f07f663dfc737bb35992e8c2fc351935f30af512f319af5f26f0538029624b442eca00a9f00409a23f263d9d72

    • SSDEEP

      768:B/UpAHiGjRQ1kkjH918xnyzOp7OssT1pF/O71mJ/alqWXpQ/5o23bA5FPX:xUeHiWRgkkjH8nyWmJ3WXpC3M5BX

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral21behavioral22

    • Target

      qs.html

    • Size

      1KB

    • MD5

      40d00fa24b9cc44fbf2d724842808473

    • SHA1

      c0852aa2fb916c051652a8b2142ffb9d8c7ac87a

    • SHA256

      35b0f1bb808e1623ad534fbc1e72cea25ac28f71340e9c543f01d1bfdd094035

    • SHA512

      9eb750e08ca9750988290626ae8ed32a2ecfa7c8ca021b3e26b3da0a94de952b991a9a6a0ad5729d7d5ccf7b3b36fb36fd24047f705d0468ad04908ba8a7154c

    Score
    3/10
    discovery
    behavioral23behavioral24

MITRE ATT&CK Enterprise v15

Tasks

static1

ardamax
Score
10/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

ardamaxdiscoverykeyloggerpersistencestealer
Score
10/10

behavioral4

ardamaxdiscoverykeyloggerpersistencestealer
Score
10/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discoverypersistence
Score
6/10

behavioral12

discoverypersistence
Score
6/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

discoverypersistence
Score
6/10

behavioral20

discoverypersistence
Score
6/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10