Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_7d300f23ef4a1aff0f5c543e9f2d4c73
-
Size
503KB
-
Sample
250317-g827aawlx7
-
MD5
7d300f23ef4a1aff0f5c543e9f2d4c73
-
SHA1
cf5e01e9f2dc3b77d04352296e2d7870d5e8e2f9
-
SHA256
26ed26117314bfe364cdfd60727a4202a32a87a89869b80b3e11e4ed00b73cb0
-
SHA512
2c3c9769435cc137498cb7fdaea2d1fbb5274b6e271829640ef182f8231f2a5ea51a991d056b65ba8e87d3c5da2d5c45423409110fccf38b9dbe415d0d85f20b
-
SSDEEP
12288:WlQRUTV5nYr0x7CUPsyoNuEv9z4x3N7M88xmQ8Qv6rrfLMRwuit:YTV5nvMUCuEv9z4dOxmcSXLIS
Malware Config
Targets
-
-
Target
JaffaCakes118_7d300f23ef4a1aff0f5c543e9f2d4c73
-
Size
503KB
-
MD5
7d300f23ef4a1aff0f5c543e9f2d4c73
-
SHA1
cf5e01e9f2dc3b77d04352296e2d7870d5e8e2f9
-
SHA256
26ed26117314bfe364cdfd60727a4202a32a87a89869b80b3e11e4ed00b73cb0
-
SHA512
2c3c9769435cc137498cb7fdaea2d1fbb5274b6e271829640ef182f8231f2a5ea51a991d056b65ba8e87d3c5da2d5c45423409110fccf38b9dbe415d0d85f20b
-
SSDEEP
12288:WlQRUTV5nYr0x7CUPsyoNuEv9z4x3N7M88xmQ8Qv6rrfLMRwuit:YTV5nvMUCuEv9z4dOxmcSXLIS
Score10/10-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-