ardamax

Sharing

Copy URL Twitter E-mail

General

Target
b3bc2b33320defe98bf6360699b76afb
Size 2.0MB
Sample240305-em1p8aef84
SHA256 7981c067ad5f8c4880fff55719b09c0c8511ab4d41205de662ad017f02ff8bba
MD5 b3bc2b33320defe98bf6360699b76afb
SHA1 a98d03be26e248dd6409775e88eafbc999535efd
SHA512 5350a8259d4cc487256232f9e660d5d5cdc9c6d6ad01581d04b1667fee41f311282f2db9f17e3c9c101ea71ce3b1bbb586f6275949322e25fa40fb376d1bcd45
SSDEEP 49152:mgLYS8PhtzTy5kWiQT8TLqoadxT4hhK6DvxCoC:mUYS8zeqW5TqNab4hNZCoC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b3bc2b33320defe98bf6360699b76afb
- Size 2.0MB
- SHA256 7981c067ad5f8c4880fff55719b09c0c8511ab4d41205de662ad017f02ff8bba
- MD5 b3bc2b33320defe98bf6360699b76afb
- SHA1 a98d03be26e248dd6409775e88eafbc999535efd
- SHA512 5350a8259d4cc487256232f9e660d5d5cdc9c6d6ad01581d04b1667fee41f311282f2db9f17e3c9c101ea71ce3b1bbb586f6275949322e25fa40fb376d1bcd45
- SSDEEP 49152:mgLYS8PhtzTy5kWiQT8TLqoadxT4hhK6DvxCoC:mUYS8zeqW5TqNab4hNZCoC
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ardamax keylogger stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 10KB
- SHA256 4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
- MD5 055f4f9260e07fc83f71877cbb7f4fad
- SHA1 a245131af1a182de99bd74af9ff1fab17977a72f
- SHA512 a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
- SSDEEP 192:8SEWBGgiJM4LN+xq56XdNcNz/NWdlJmlyOcROQ:8SEPgii9KTzyt
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/DcryptDll.dll
- Size 18KB
- SHA256 debc1bc6f2f109a0fc230d9cf8cbb74055ac7513ff78a81fd12c0015be680add
- MD5 e35a86826715716a069bd52201dabc57
- SHA1 0d679294d68250d22d3854ebf193263bf8b20bfe
- SHA512 dae618bfa1f012d2cdfc7199ba8aca20f7aa6f6614e57d9bd74658a17a72e17b6127231b86b3c966b258b24731c17e0a6ad2a315bd722d3f407ae52c97bcbf26
- SSDEEP 384:KZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMj6:KbtwnmR/xQdckUSEMj6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 3a18cf504265ab2267e1545106217767877fa9db6e2b5dd0a3a761dead33a99b
- MD5 07841403d5371183c4eaa5cab50663fb
- SHA1 b0cee6e01502fdd2ee775922051333d626c63906
- SHA512 436c1932d4ff56a11673beac5416ac0f2c7e90e5b993b3b8c8f589069d655da40c3ed514b99291ddf06aad66b0a634896daac19adf459ff791dccf3234af0e05
- SSDEEP 192:sQNEcPshjd/dVaWnYPSZWrR6CM6CjVWsqCDLjJO/FEg98ZH:sQvshxFVaeYPoWH0VWsqCHQ/FEg9w
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  Uninstall.exe
- Size 51KB
- SHA256 4ebdc9cf0c1addadf0070c64424d1792a90006dfa762b6459ddcae813e0c0825
- MD5 e98c4556ea75dbfccb0f7ec340ca3548
- SHA1 d41ffd10b8c5279c0e6273576f8a5855360f0087
- SHA512 8e1c660a9da7c674fbc865b4c7667f3e7c97bf99aff6ca91ba8740f136cfc3c1bd6a3dc1c02432ccb55bb361bb36b62cb985ae7c543bb6c008cebaa9dce215eb
- SSDEEP 1536:wLXB65939tY6HBg4sXJJlitGl1VhurNmvOq0A:wLk395hYXJ7PTu5I7
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 3a18cf504265ab2267e1545106217767877fa9db6e2b5dd0a3a761dead33a99b
- MD5 07841403d5371183c4eaa5cab50663fb
- SHA1 b0cee6e01502fdd2ee775922051333d626c63906
- SHA512 436c1932d4ff56a11673beac5416ac0f2c7e90e5b993b3b8c8f589069d655da40c3ed514b99291ddf06aad66b0a634896daac19adf459ff791dccf3234af0e05
- SSDEEP 192:sQNEcPshjd/dVaWnYPSZWrR6CM6CjVWsqCDLjJO/FEg98ZH:sQvshxFVaeYPoWH0VWsqCHQ/FEg9w
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  lzma.exe
- Size 63KB
- SHA256 f776415281ed68268577142b60839d0937c112be1ba0fb8470f5a387afc3ba62
- MD5 1c4d758c0954e843d2fa22703f653421
- SHA1 d577e6f63cb53f5f68f094b9fbaefe5b0087e933
- SHA512 5b8c02473b8f57d243cac5ae1f5381a9a1dbd55bc976a172f36060b2d0c2ad80d4f956cd38d4ba7434b9b27583e0e753bcdb8b4772c1c54e926b365c90357c3e
- SSDEEP 1536:ax7F8DW6pErklzKbDir++/McTJctWOrLRCIbDO+9a:akDWTrMKb2MFQCRCIe+4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ardamax main executable

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22