Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48

  • Size

    2.1MB

  • Sample

    221203-wzn1madf95

  • MD5

    326e062ef4cd0703fd25cad2b790a9de

  • SHA1

    80a485276b8e9226b707ca6a91b22d9e57d6b3ab

  • SHA256

    1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48

  • SHA512

    797b33b0f129dfda1b279d71fe8f12cc5d7b7d972500d68a7c3a844d8200202b1f27ca1b1b07da2a6cb4c5d438bf19b5478ae16cd9d8ba1eef409596d9c5de3e

  • SSDEEP

    49152:jULTQS5es7C6ealJs497FYVJwyeJR2Gww9N5qp+p:jU4sneQP9xYVMJR2GVHG

Malware Config

Targets

    • Target

      1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48

    • Size

      2.1MB

    • MD5

      326e062ef4cd0703fd25cad2b790a9de

    • SHA1

      80a485276b8e9226b707ca6a91b22d9e57d6b3ab

    • SHA256

      1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48

    • SHA512

      797b33b0f129dfda1b279d71fe8f12cc5d7b7d972500d68a7c3a844d8200202b1f27ca1b1b07da2a6cb4c5d438bf19b5478ae16cd9d8ba1eef409596d9c5de3e

    • SSDEEP

      49152:jULTQS5es7C6ealJs497FYVJwyeJR2Gww9N5qp+p:jU4sneQP9xYVMJR2GVHG

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks