Overview

overview

10

Static

static

3

JaffaCakes...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b12318878041f39ab24ee6e78cd4744c

  • Size

    2.7MB

  • Sample

    250412-e82jmsw1ez

  • MD5

    b12318878041f39ab24ee6e78cd4744c

  • SHA1

    b0044bb11910e2faa2d30a25b76b9e6c1f2727fb

  • SHA256

    363f9328428974e07ed2cf2b43dec54db8fcbd3118b020e094e5d94eff1f39f5

  • SHA512

    f46ce53c7c7f3f0ea2bf8d7ec989ab7c0aeeea90baed19b4415142416624213be324c0c1e3f07f29dbb488301134de11092cb72457dd967bde3d5318e8a23679

  • SSDEEP

    49152:SnVNjzVQarhahr09CSL0DqwCp29J6PlRfju/hRSB9rycJjDSvzu5gTMND/QLWYL9:SnVNSmqr0IS7RKJi5KZRS7p9n5gTMR/W

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_b12318878041f39ab24ee6e78cd4744c

    • Size

      2.7MB

    • MD5

      b12318878041f39ab24ee6e78cd4744c

    • SHA1

      b0044bb11910e2faa2d30a25b76b9e6c1f2727fb

    • SHA256

      363f9328428974e07ed2cf2b43dec54db8fcbd3118b020e094e5d94eff1f39f5

    • SHA512

      f46ce53c7c7f3f0ea2bf8d7ec989ab7c0aeeea90baed19b4415142416624213be324c0c1e3f07f29dbb488301134de11092cb72457dd967bde3d5318e8a23679

    • SSDEEP

      49152:SnVNjzVQarhahr09CSL0DqwCp29J6PlRfju/hRSB9rycJjDSvzu5gTMND/QLWYL9:SnVNSmqr0IS7RKJi5KZRS7p9n5gTMR/W

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks