Overview

overview

10

Static

static

3

JaffaCakes...0d.exe

windows10-2004-x64

10

JaffaCakes...0d.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c1625ab3e986ecc00f57cd485076500d

  • Size

    503KB

  • Sample

    250419-fszksav1by

  • MD5

    c1625ab3e986ecc00f57cd485076500d

  • SHA1

    74031342d823a0e6a6bd4f1edfe459da06ce9222

  • SHA256

    ecc2fc1422d8b07d4331ed65fda2738b1db78ec057b95a46bf163c6ed5487b10

  • SHA512

    b04477c6456dcf5f8761c63ca4c83e4eb2e38e075170a152ba4b409f42dd22c1ae3c8ebfbd5fa36003b0f11be7c9afccbd4995e65c7d8c2065360be57c60f2cb

  • SSDEEP

    12288:5M23kuH2NJk+wXp29P1uLVf6xIFDQiOdRJmpWko7V+S2SUoZWxt:e2USjzXokLVfUyDjynmp5oX2Sq

Score
10/10
ardamaxdefense_evasiondiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      JaffaCakes118_c1625ab3e986ecc00f57cd485076500d

    • Size

      503KB

    • MD5

      c1625ab3e986ecc00f57cd485076500d

    • SHA1

      74031342d823a0e6a6bd4f1edfe459da06ce9222

    • SHA256

      ecc2fc1422d8b07d4331ed65fda2738b1db78ec057b95a46bf163c6ed5487b10

    • SHA512

      b04477c6456dcf5f8761c63ca4c83e4eb2e38e075170a152ba4b409f42dd22c1ae3c8ebfbd5fa36003b0f11be7c9afccbd4995e65c7d8c2065360be57c60f2cb

    • SSDEEP

      12288:5M23kuH2NJk+wXp29P1uLVf6xIFDQiOdRJmpWko7V+S2SUoZWxt:e2USjzXokLVfUyDjynmp5oX2Sq

    Score
    10/10
    ardamaxdefense_evasiondiscoverykeyloggerstealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks