ardamax

General

Target

ffbaf9d797e73db3d96a755c3b4b8721f4cc6ff555b13ef84c7b66b44e0eeb2b
Size

678KB
Sample

221002-tdyxladed5
MD5

02f07340354f14244fad58f72c0d82f3
SHA1

4c37494ac7ef9247d982d76930e773513102f492
SHA256

ffbaf9d797e73db3d96a755c3b4b8721f4cc6ff555b13ef84c7b66b44e0eeb2b
SHA512

83a781eeb6bf13f3e08c78d9aa16fc616ededb8e83597dee998ebd25a8b446504ff4ecd17d9b349cec84bd53d8c96a16c1ef4df6de3547aa6709016709baa8e0
SSDEEP

12288:C3TdtLW5WIj1YSSdFxBRZFBLZvBSXyMzBUWb9lx/9AgHLo8OW+rB8:cDsj1dEnxJBcJ9nPx/igrp+q

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  ffbaf9d797e73db3d96a755c3b4b8721f4cc6ff555b13ef84c7b66b44e0eeb2b
- Size
  
  678KB
- MD5
  
  02f07340354f14244fad58f72c0d82f3
- SHA1
  
  4c37494ac7ef9247d982d76930e773513102f492
- SHA256
  
  ffbaf9d797e73db3d96a755c3b4b8721f4cc6ff555b13ef84c7b66b44e0eeb2b
- SHA512
  
  83a781eeb6bf13f3e08c78d9aa16fc616ededb8e83597dee998ebd25a8b446504ff4ecd17d9b349cec84bd53d8c96a16c1ef4df6de3547aa6709016709baa8e0
- SSDEEP
  
  12288:C3TdtLW5WIj1YSSdFxBRZFBLZvBSXyMzBUWb9lx/9AgHLo8OW+rB8:cDsj1dEnxJBcJ9nPx/igrp+q
Score

10^/10

ardamax sality backdoor discovery evasion keylogger persistence stealer trojan upx
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Modifies WinLogon for persistence
  persistence
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2