Overview

overview

10

Static

static

3

JaffaCakes...57.exe

windows7-x64

10

JaffaCakes...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bc6689be58722aed1bea0dbe39c31157

  • Size

    177KB

  • Sample

    250207-22pylasmgs

  • MD5

    bc6689be58722aed1bea0dbe39c31157

  • SHA1

    b015f6486927a90e3bd7efa6b0dbb975cf2cbcdf

  • SHA256

    46d490798d0aad8159e98304a96729cb4eb9c6d72acfdb6a32be84f91b4751cc

  • SHA512

    e8c82bb2ad710703f352363e0b2c77dbd6b2bbd6494c5a5a24f6fe24e064ffa590c86b39ca2052539ef0c91abb2d7b82458f04e624b909dffb3a82edf808311e

  • SSDEEP

    3072:uCNmpyGSrTe4wMjMMFPMex9b4UApEvOJ7DW7u7PkmkLpPdMF4depy:bmpyGyXwMAex9bpAUOJ7m8klP2F4Gy

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      JaffaCakes118_bc6689be58722aed1bea0dbe39c31157

    • Size

      177KB

    • MD5

      bc6689be58722aed1bea0dbe39c31157

    • SHA1

      b015f6486927a90e3bd7efa6b0dbb975cf2cbcdf

    • SHA256

      46d490798d0aad8159e98304a96729cb4eb9c6d72acfdb6a32be84f91b4751cc

    • SHA512

      e8c82bb2ad710703f352363e0b2c77dbd6b2bbd6494c5a5a24f6fe24e064ffa590c86b39ca2052539ef0c91abb2d7b82458f04e624b909dffb3a82edf808311e

    • SSDEEP

      3072:uCNmpyGSrTe4wMjMMFPMex9b4UApEvOJ7DW7u7PkmkLpPdMF4depy:bmpyGyXwMAex9bpAUOJ7m8klP2F4Gy

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks