ardamax

Sharing

Copy URL Twitter E-mail

General

Target
90b0b68127f75c6a3440d7e01775559e
Size 2.0MB
Sample240205-bzg7vsffc5
SHA256 3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9
MD5 90b0b68127f75c6a3440d7e01775559e
SHA1 ed6f93ddcc2e36fcf50f5e5cb8dddc6878c83e1d
SHA512 81aaedb5ecd46b75a5686bb201b725bce398531a19918887a7369b593f4212b8bdeed418247bc4be1f5bcab656d15974d8e1d1e3c9ea714d451faed3fe098aa9
SSDEEP 49152:zKwnQ8lF+i3nE2PKIgrMWbid/swD0CU/2wZOIn:zKOb2izPMrMWs3DU2wZR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  90b0b68127f75c6a3440d7e01775559e
- Size 2.0MB
- SHA256 3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9
- MD5 90b0b68127f75c6a3440d7e01775559e
- SHA1 ed6f93ddcc2e36fcf50f5e5cb8dddc6878c83e1d
- SHA512 81aaedb5ecd46b75a5686bb201b725bce398531a19918887a7369b593f4212b8bdeed418247bc4be1f5bcab656d15974d8e1d1e3c9ea714d451faed3fe098aa9
- SSDEEP 49152:zKwnQ8lF+i3nE2PKIgrMWbid/swD0CU/2wZOIn:zKOb2izPMrMWs3DU2wZR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ardamax keylogger stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 8KB
- SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
- MD5 9f1a88b953fd2a2c23b09703b253186c
- SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
- SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
- SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  $PLUGINSDIR/DcryptDll.dll
- Size 18KB
- SHA256 db8917ced7cdce480313476ddcf5ebf700fed92d0a347f1db96f47cb5378422d
- MD5 e8192915d70fcb1107486e48b3b16a7a
- SHA1 ec9d2eba81dbc631c907c6b0a3cbe55897f1325f
- SHA512 86ad3eff31a22b31f1619d24469c41db0075bc5aa2590603a70b377766197589135bea53be1687b9f136eff4608529202da7b40de94e2342cda7ac6dd74a5a33
- SSDEEP 384:AZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMT6:AbtwnmR/xQdckUSEMT6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  Uninstall.exe
- Size 51KB
- SHA256 625d52d73b2a00841751eb9bb106d91c74703b7f12e7a56c6950070190dc6e58
- MD5 bd7e4a59e9c46c47a5442d271fd582ee
- SHA1 7119ce221917e6f0791746a9ba5ee6df1ac87e01
- SHA512 a9cf689dded2866e9bfdab34c5199c41db9498f46299919d9d68b4d5676317477c898308e674e06a5bbde5c3275a739b3a6a316ac93ca86bfabdea7636a2ae6f
- SSDEEP 1536:wLXB65939tY6HBg4sXJJl73Gl1VhzDRE9U+idVe:wLk395hYXJ77YTve9WDe
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  lzma.exe
- Size 63KB
- SHA256 f776415281ed68268577142b60839d0937c112be1ba0fb8470f5a387afc3ba62
- MD5 1c4d758c0954e843d2fa22703f653421
- SHA1 d577e6f63cb53f5f68f094b9fbaefe5b0087e933
- SHA512 5b8c02473b8f57d243cac5ae1f5381a9a1dbd55bc976a172f36060b2d0c2ad80d4f956cd38d4ba7434b9b27583e0e753bcdb8b4772c1c54e926b365c90357c3e
- SSDEEP 1536:ax7F8DW6pErklzKbDir++/McTJctWOrLRCIbDO+9a:akDWTrMKb2MFQCRCIe+4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ardamax main executable

Loads dropped DLL

UPX packed file

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22