Overview

overview

10

Static

static

3

JaffaCakes...30.exe

windows7-x64

10

JaffaCakes...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6ec0991158855ef68f6bdd57f4a75a30

  • Size

    506KB

  • Sample

    250131-275agazjh1

  • MD5

    6ec0991158855ef68f6bdd57f4a75a30

  • SHA1

    3cfa88e5a93d492aa156a0059e73fa6219c1e6de

  • SHA256

    a52b3f4b904bb7d7a7810ad1aba417a3ec53a8d43b2d2f3f89688d601a711151

  • SHA512

    f056a767038842f12b94bf433958f3757a94189bf03dfcaf23880479a54c647dee9d52ccb964882a3ed179a863d997f78448646e32ccb0d930a516c723590e2b

  • SSDEEP

    12288:xne8lvfDf3GeLeJ9vH+Qeii0pNKMj0+RkYnd6OaX:M8R3dUVHXj7jQi2X

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_6ec0991158855ef68f6bdd57f4a75a30

    • Size

      506KB

    • MD5

      6ec0991158855ef68f6bdd57f4a75a30

    • SHA1

      3cfa88e5a93d492aa156a0059e73fa6219c1e6de

    • SHA256

      a52b3f4b904bb7d7a7810ad1aba417a3ec53a8d43b2d2f3f89688d601a711151

    • SHA512

      f056a767038842f12b94bf433958f3757a94189bf03dfcaf23880479a54c647dee9d52ccb964882a3ed179a863d997f78448646e32ccb0d930a516c723590e2b

    • SSDEEP

      12288:xne8lvfDf3GeLeJ9vH+Qeii0pNKMj0+RkYnd6OaX:M8R3dUVHXj7jQi2X

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks