Overview

overview

10

Static

static

3

JaffaCakes...e7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b6837c8fb808a9c73f20b310b3a7ebe7

  • Size

    486KB

  • Sample

    250414-d8lbzszwct

  • MD5

    b6837c8fb808a9c73f20b310b3a7ebe7

  • SHA1

    2ba0d2b8e1d0fbe3867a0f92a9dfc7ee492849de

  • SHA256

    9ad9e46ee215c7bec168ba9c77e8c6965eaa6978e24fd5023d44176d33475aad

  • SHA512

    71f85dfa6da25b4684bc97b8159210acf8918fe12d84789a4b094006ee18478e3296ef758758e6b1c739948601f87448a72bcaadf1ca1fa372a3d7716b9e0080

  • SSDEEP

    12288:p7+rP2SaIre6TXDFC27eqHPJcu9Vf9eL+p/OCZsEJphoGr4WhFtIifuB:SbioXDFoqvyu919JdOC5J4Gcethg

Score
10/10
ardamaxdiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      JaffaCakes118_b6837c8fb808a9c73f20b310b3a7ebe7

    • Size

      486KB

    • MD5

      b6837c8fb808a9c73f20b310b3a7ebe7

    • SHA1

      2ba0d2b8e1d0fbe3867a0f92a9dfc7ee492849de

    • SHA256

      9ad9e46ee215c7bec168ba9c77e8c6965eaa6978e24fd5023d44176d33475aad

    • SHA512

      71f85dfa6da25b4684bc97b8159210acf8918fe12d84789a4b094006ee18478e3296ef758758e6b1c739948601f87448a72bcaadf1ca1fa372a3d7716b9e0080

    • SSDEEP

      12288:p7+rP2SaIre6TXDFC27eqHPJcu9Vf9eL+p/OCZsEJphoGr4WhFtIifuB:SbioXDFoqvyu919JdOC5J4Gcethg

    Score
    10/10
    ardamaxdiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks