Overview

overview

10

Static

static

3

JaffaCakes...4d.exe

windows7-x64

10

JaffaCakes...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c76ad6972f8faddae5fd17f3654cd94d

  • Size

    603KB

  • Sample

    250208-z1dststmcy

  • MD5

    c76ad6972f8faddae5fd17f3654cd94d

  • SHA1

    299f564fe88d1b4a36aab11e864b862043eed825

  • SHA256

    19930c08bb581aba6540bcfe0f561f5dd5a4a498be9930bd529f416d67e7bb46

  • SHA512

    ce803b0f446a328271f82cde511e35880d9bb744d24cd961863c5c1477b84a992f26e7b8b33016457e095cca13a0662b0000655e38d014f7f62d64f7dae2f197

  • SSDEEP

    12288:1z+E4EDqyjkl4EvzmSYlMT8ibZkBd9c0HwS/LX4wzmKBK:N+cjO4E7mSVT8il09LX3y7

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_c76ad6972f8faddae5fd17f3654cd94d

    • Size

      603KB

    • MD5

      c76ad6972f8faddae5fd17f3654cd94d

    • SHA1

      299f564fe88d1b4a36aab11e864b862043eed825

    • SHA256

      19930c08bb581aba6540bcfe0f561f5dd5a4a498be9930bd529f416d67e7bb46

    • SHA512

      ce803b0f446a328271f82cde511e35880d9bb744d24cd961863c5c1477b84a992f26e7b8b33016457e095cca13a0662b0000655e38d014f7f62d64f7dae2f197

    • SSDEEP

      12288:1z+E4EDqyjkl4EvzmSYlMT8ibZkBd9c0HwS/LX4wzmKBK:N+cjO4E7mSVT8il09LX3y7

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks