Overview

overview

10

Static

static

3

JaffaCakes...02.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b4aa94babbb6e79bc3c56aa5a7a43d02

  • Size

    166KB

  • Sample

    250413-pn445swvgv

  • MD5

    b4aa94babbb6e79bc3c56aa5a7a43d02

  • SHA1

    e05f0e433d82744e1ab98650c97b41fb24ba8fcc

  • SHA256

    2e1fc943616090f81107f6c66be47d071f3f4ce2a46a9bc3ee1e0bf086785796

  • SHA512

    4e429a7a56b5fa30c94c1b33c92919ef3d1566482f3196a853047de5d5a5ca9fb04234b8147863aaac53f610659976d2c4b746fceefc81959560668e32f2b671

  • SSDEEP

    3072:iO0SR1+aJe1mgawzxsBub861jIHxowjhgDILLlAKziHUtBv1DBGvu89OEPGSG141:lRUTV5n0gCLlAKz0UtBvpBGjOsZtv

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      JaffaCakes118_b4aa94babbb6e79bc3c56aa5a7a43d02

    • Size

      166KB

    • MD5

      b4aa94babbb6e79bc3c56aa5a7a43d02

    • SHA1

      e05f0e433d82744e1ab98650c97b41fb24ba8fcc

    • SHA256

      2e1fc943616090f81107f6c66be47d071f3f4ce2a46a9bc3ee1e0bf086785796

    • SHA512

      4e429a7a56b5fa30c94c1b33c92919ef3d1566482f3196a853047de5d5a5ca9fb04234b8147863aaac53f610659976d2c4b746fceefc81959560668e32f2b671

    • SSDEEP

      3072:iO0SR1+aJe1mgawzxsBub861jIHxowjhgDILLlAKziHUtBv1DBGvu89OEPGSG141:lRUTV5n0gCLlAKz0UtBvpBGjOsZtv

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks