Overview

overview

10

Static

static

3

JaffaCakes...1d.exe

windows10-2004-x64

10

JaffaCakes...1d.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ba9fee12b62b3667be0057bebfb36d1d

  • Size

    565KB

  • Sample

    250417-w12ywaznw8

  • MD5

    ba9fee12b62b3667be0057bebfb36d1d

  • SHA1

    132e23ef52e247c70566f87f3d06f31c2589199d

  • SHA256

    bfb83e2340a159f8c39d6be30c664ecf4ebd55f63f0ab0dff920d79c7ee6fec4

  • SHA512

    edc2334f38dfface0c6e881b45d0b5852538cefb642af36236e76ab6f5dd93a9c68b33f921a07eb6eca6e70d4139eccd13db3ae69c24d796a31d62e7770fb679

  • SSDEEP

    12288:KYXJloqGjwi/7HrdbaX5nJLnJHg9UYNz9I72HHWVWfwwUoH7eU9:tsjbjNaXJJCACGWYwUZU9

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_ba9fee12b62b3667be0057bebfb36d1d

    • Size

      565KB

    • MD5

      ba9fee12b62b3667be0057bebfb36d1d

    • SHA1

      132e23ef52e247c70566f87f3d06f31c2589199d

    • SHA256

      bfb83e2340a159f8c39d6be30c664ecf4ebd55f63f0ab0dff920d79c7ee6fec4

    • SHA512

      edc2334f38dfface0c6e881b45d0b5852538cefb642af36236e76ab6f5dd93a9c68b33f921a07eb6eca6e70d4139eccd13db3ae69c24d796a31d62e7770fb679

    • SSDEEP

      12288:KYXJloqGjwi/7HrdbaX5nJLnJHg9UYNz9I72HHWVWfwwUoH7eU9:tsjbjNaXJJCACGWYwUZU9

    Score
    10/10
    ardamaxdiscoverykeyloggerstealerpersistence

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks