Overview

overview

10

Static

static

3

JaffaCakes...20.exe

windows7-x64

10

JaffaCakes...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_dd700ca99586abf9809d129e85992220

  • Size

    787KB

  • Sample

    250210-t7cw8axndr

  • MD5

    dd700ca99586abf9809d129e85992220

  • SHA1

    af96aa2c9694af76cf29fdcc62117dfcf459286f

  • SHA256

    54e306fdb70d497c0d6952bfc71c30b8a9b161b52db731b5e91a07a2f1d12708

  • SHA512

    bdbdd88cab16585555b10317ff31455cd22e8c0a579e88b78f3ce369fb801009e233e29985d582a67b68afa0b40b887d0534a0a4ceb2d3541956c4256ad3a770

  • SSDEEP

    24576:i6qCqjoAaQ93UZxwkeXb1NGAWcbIaqMjOFspqpAg0n45W3:i6qCqd9EveXBNGmXj0AQ5U

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_dd700ca99586abf9809d129e85992220

    • Size

      787KB

    • MD5

      dd700ca99586abf9809d129e85992220

    • SHA1

      af96aa2c9694af76cf29fdcc62117dfcf459286f

    • SHA256

      54e306fdb70d497c0d6952bfc71c30b8a9b161b52db731b5e91a07a2f1d12708

    • SHA512

      bdbdd88cab16585555b10317ff31455cd22e8c0a579e88b78f3ce369fb801009e233e29985d582a67b68afa0b40b887d0534a0a4ceb2d3541956c4256ad3a770

    • SSDEEP

      24576:i6qCqjoAaQ93UZxwkeXb1NGAWcbIaqMjOFspqpAg0n45W3:i6qCqd9EveXBNGmXj0AQ5U

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks