ardamax | 97ac7654e6110373718e5f6791f4d5966853447f746c7468d75d5c33695520bd | Triage

Sharing

General

Target

d6b89d01974061e0bc182589c9925ab0_JaffaCakes118
Size

1.0MB
Sample

240909-t9xpea1cke
MD5

d6b89d01974061e0bc182589c9925ab0
SHA1

2e40321120aa79b3246dc770a51c70dc3d342593
SHA256

97ac7654e6110373718e5f6791f4d5966853447f746c7468d75d5c33695520bd
SHA512

2e2e369af2809469457a2f282c426705b9b982638432efe88056f92ea76db7f32149c82157b673c21f06772e7cac257c6e0d26fae21999c1003bcaec8a568c61
SSDEEP

24576:jjXTuTV5nmIWSyhFvSE7NLtTc83agabRhLZuFJZnfjfrgMHyK3i8LCfr:jDTwUFvn7NBc8KnLMrxfHZHyN8LYr

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  d6b89d01974061e0bc182589c9925ab0_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  d6b89d01974061e0bc182589c9925ab0
- SHA1
  
  2e40321120aa79b3246dc770a51c70dc3d342593
- SHA256
  
  97ac7654e6110373718e5f6791f4d5966853447f746c7468d75d5c33695520bd
- SHA512
  
  2e2e369af2809469457a2f282c426705b9b982638432efe88056f92ea76db7f32149c82157b673c21f06772e7cac257c6e0d26fae21999c1003bcaec8a568c61
- SSDEEP
  
  24576:jjXTuTV5nmIWSyhFvSE7NLtTc83agabRhLZuFJZnfjfrgMHyK3i8LCfr:jDTwUFvn7NBc8KnLMrxfHZHyN8LYr
Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer