Overview

overview

10

Static

static

0fad48bdf9...c8.exe

windows7-x64

10

0fad48bdf9...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fad48bdf98148ff3b132664a5ea90472994248c53b32e26fd13942c7dcba6c8

  • Size

    2.0MB

  • Sample

    221125-stj8psbc9s

  • MD5

    aecbf512a59d00833a625124e053da54

  • SHA1

    93dae325d30a3db903abf76a6c09a5f951191798

  • SHA256

    0fad48bdf98148ff3b132664a5ea90472994248c53b32e26fd13942c7dcba6c8

  • SHA512

    8120ffe1ba457e7a52a585e1111a4fba28f4b590caa5699f3024815e1e5edc51df1b83edab3d01bbbed587f1283bf7bcb38fcc03605f13ef6ff50e0a54d4aab3

  • SSDEEP

    24576:KOaG6qI2pVmvx0szWSvJIuEEtEQ+eEcWqhGzOOPPJJd3RMiOQ9R6GwsOlx0RtKSn:k2peSsiSJI4ThGz5hkQ9sR0vtMx

Score
10/10
ardamaxkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      0fad48bdf98148ff3b132664a5ea90472994248c53b32e26fd13942c7dcba6c8

    • Size

      2.0MB

    • MD5

      aecbf512a59d00833a625124e053da54

    • SHA1

      93dae325d30a3db903abf76a6c09a5f951191798

    • SHA256

      0fad48bdf98148ff3b132664a5ea90472994248c53b32e26fd13942c7dcba6c8

    • SHA512

      8120ffe1ba457e7a52a585e1111a4fba28f4b590caa5699f3024815e1e5edc51df1b83edab3d01bbbed587f1283bf7bcb38fcc03605f13ef6ff50e0a54d4aab3

    • SSDEEP

      24576:KOaG6qI2pVmvx0szWSvJIuEEtEQ+eEcWqhGzOOPPJJd3RMiOQ9R6GwsOlx0RtKSn:k2peSsiSJI4ThGz5hkQ9sR0vtMx

    Score
    10/10
    ardamaxkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks