Overview

overview

10

Static

static

3

JaffaCakes...48.exe

windows10-2004-x64

10

JaffaCakes...48.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bdd2a3840b3c1f63e435e67cbe2de348

  • Size

    585KB

  • Sample

    250418-nfheqstn15

  • MD5

    bdd2a3840b3c1f63e435e67cbe2de348

  • SHA1

    30e1e8cb31fb87e8430dd6acdf2777c0878fb784

  • SHA256

    94d8f9fbe794f971bb2769418981c2a7b5af78afe340f92dafbb2ad1eb71b91e

  • SHA512

    2fce83239ae6a87759b6f80ea4b7a7b0f920525382a21262fb84663f9c8c7e714a5930f8eb035854d711ba7e0781e035dda9b664f9dec9c9eea474ec43f636ae

  • SSDEEP

    12288:5deoUab7FwNHF45cDVLZp5y3CX2P9y8AuN6P0vBT0iT2yiHadb:m+9wVF42Zp09g8AcBThqyiH2b

Score
10/10
ardamaxaspackv2discoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_bdd2a3840b3c1f63e435e67cbe2de348

    • Size

      585KB

    • MD5

      bdd2a3840b3c1f63e435e67cbe2de348

    • SHA1

      30e1e8cb31fb87e8430dd6acdf2777c0878fb784

    • SHA256

      94d8f9fbe794f971bb2769418981c2a7b5af78afe340f92dafbb2ad1eb71b91e

    • SHA512

      2fce83239ae6a87759b6f80ea4b7a7b0f920525382a21262fb84663f9c8c7e714a5930f8eb035854d711ba7e0781e035dda9b664f9dec9c9eea474ec43f636ae

    • SSDEEP

      12288:5deoUab7FwNHF45cDVLZp5y3CX2P9y8AuN6P0vBT0iT2yiHadb:m+9wVF42Zp09g8AcBThqyiH2b

    Score
    10/10
    ardamaxaspackv2discoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks