Overview

overview

10

Static

static

3

JaffaCakes...ed.exe

windows10-2004-x64

10

JaffaCakes...ed.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bc1e2fa00e96107a61c5f02ca45f29ed

  • Size

    2.9MB

  • Sample

    250418-ch7a4ayydz

  • MD5

    bc1e2fa00e96107a61c5f02ca45f29ed

  • SHA1

    9cc3d09ead713082ac2d8d55675850b07409f104

  • SHA256

    1a7f9ba3014865a13a045efb45cc187f1b5b0bc3aa62325dbcc0c65dd31a0c8e

  • SHA512

    6ed04fedbf14e3f3e098425866a3ba16c60806be4739b485367f59df5efeeab06738d099c6114863a3417c9d8fa64ba110016f0cec58892c19a344f1fe607f2a

  • SSDEEP

    49152:E64MTrF+YbJvVU35UKlidG3cptoPRyYtMmgVbIpjJAJKa3j9IZRnmOQpyt83Bin2:E61cYxg5iPpiRnrGbIpu8g9gEpytKBww

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_bc1e2fa00e96107a61c5f02ca45f29ed

    • Size

      2.9MB

    • MD5

      bc1e2fa00e96107a61c5f02ca45f29ed

    • SHA1

      9cc3d09ead713082ac2d8d55675850b07409f104

    • SHA256

      1a7f9ba3014865a13a045efb45cc187f1b5b0bc3aa62325dbcc0c65dd31a0c8e

    • SHA512

      6ed04fedbf14e3f3e098425866a3ba16c60806be4739b485367f59df5efeeab06738d099c6114863a3417c9d8fa64ba110016f0cec58892c19a344f1fe607f2a

    • SSDEEP

      49152:E64MTrF+YbJvVU35UKlidG3cptoPRyYtMmgVbIpjJAJKa3j9IZRnmOQpyt83Bin2:E61cYxg5iPpiRnrGbIpu8g9gEpytKBww

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks