Extracted

• • Target

    JaffaCakes118_8fe47798bc47d7b775803e1dbef3c8be

  • Size

    2.3MB

  • MD5

    8fe47798bc47d7b775803e1dbef3c8be

  • SHA1

    bce6475d95dc735f3c0f308d40916f2931a7955b

  • SHA256

    ed4a22e4be09281a3450114792f3ebfae0c0b1106b96331c30c6cef4d6b73618

  • SHA512

    fef0aaaea2464223f9897f97911ae38bda6411e88261095c8b25f766f1d0c86dfdec4b86ea03faceaac462a042d7ac55cda96254c1327eeed1b69923f090090f

  • SSDEEP

    49152:vucTMaQtsTAcapB8h6S8MKOaK6P0h04dg310EcZ09EjvMj:vcJsTxgBd7tI6PS04eKEEbMj

  Score

  10^/10

  ardamaxdiscoverykeyloggerpersistencestealer

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax family

    ardamax

  • Ardamax main executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2