Overview

overview

10

Static

static

3

JaffaCakes...bb.exe

windows7-x64

10

JaffaCakes...bb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8788bfd01a2f4c96b5f239a241ec7fbb

  • Size

    272KB

  • Sample

    250203-ml4pgszrcl

  • MD5

    8788bfd01a2f4c96b5f239a241ec7fbb

  • SHA1

    426974dc431cbbd1f6d168669f56c8602a97ae57

  • SHA256

    d9471ada089cfa55c5b288e3a812cc46ee7ec6ba0e4ec6ee92111710f70a74a4

  • SHA512

    d8191255ffc1250db6285f09ace0bc45c37fad9574b97bd9065431d353b7f7d259469a73248fb38c60d241014985d78e6b909d4decd9347831162f79f5ba0bc1

  • SSDEEP

    6144:1ov6Acph18MmTn5fyn42X/Hb8lEE1QMng08a+uvrnh24wvej1PYEzA:qkb8M4hyn4Cb7cQMg7N424QyQGA

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_8788bfd01a2f4c96b5f239a241ec7fbb

    • Size

      272KB

    • MD5

      8788bfd01a2f4c96b5f239a241ec7fbb

    • SHA1

      426974dc431cbbd1f6d168669f56c8602a97ae57

    • SHA256

      d9471ada089cfa55c5b288e3a812cc46ee7ec6ba0e4ec6ee92111710f70a74a4

    • SHA512

      d8191255ffc1250db6285f09ace0bc45c37fad9574b97bd9065431d353b7f7d259469a73248fb38c60d241014985d78e6b909d4decd9347831162f79f5ba0bc1

    • SSDEEP

      6144:1ov6Acph18MmTn5fyn42X/Hb8lEE1QMng08a+uvrnh24wvej1PYEzA:qkb8M4hyn4Cb7cQMg7N424QyQGA

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks