Overview

overview

10

Static

static

3

JaffaCakes...a7.exe

windows7-x64

10

JaffaCakes...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_211f876da3a190489d2dacb5a7f1c7a7

  • Size

    513KB

  • Sample

    250223-q2jwss1qx8

  • MD5

    211f876da3a190489d2dacb5a7f1c7a7

  • SHA1

    a20cc0ee9111a4ab2f80cee2760a448e1efab4d2

  • SHA256

    8673eb94afea8536d8de8b1347a01c0bd235227f184aa3b0f135a65c3d805602

  • SHA512

    92750c01e110363f5a9d1dab8b06d17dd990749f3da89e938b77c24eac83ff4f6fdaf805aa3bdd08d6dfa0689d94312136dffcffc4bb6c2b95ece5d4b30320c5

  • SSDEEP

    12288:/decm1pgVVmLjb+NaeIbhAOib4r6hV+ufBeZZHsZC:w5g3mLv+NaeuSb42nFfBeZZHGC

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_211f876da3a190489d2dacb5a7f1c7a7

    • Size

      513KB

    • MD5

      211f876da3a190489d2dacb5a7f1c7a7

    • SHA1

      a20cc0ee9111a4ab2f80cee2760a448e1efab4d2

    • SHA256

      8673eb94afea8536d8de8b1347a01c0bd235227f184aa3b0f135a65c3d805602

    • SHA512

      92750c01e110363f5a9d1dab8b06d17dd990749f3da89e938b77c24eac83ff4f6fdaf805aa3bdd08d6dfa0689d94312136dffcffc4bb6c2b95ece5d4b30320c5

    • SSDEEP

      12288:/decm1pgVVmLjb+NaeIbhAOib4r6hV+ufBeZZHsZC:w5g3mLv+NaeuSb42nFfBeZZHGC

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks