ardamax

General

Target

d8cab9f0e1d8aa81e904fd511fd4db06_JaffaCakes118
Size

657KB
Sample

240910-w1kplaygqe
MD5

d8cab9f0e1d8aa81e904fd511fd4db06
SHA1

c8f507e1184466db73e15d1ad73328b3a747c026
SHA256

3d99f295aeceacdb62e59c0728e3348f94a4261a1accbe672e3d04c9d7e2365a
SHA512

c0e094690be06e12937bd9b3279169864cf9066cd9b18449d36151a9704d13fa0c5caeb675358c1abcf1d78fc7431651a1b0211b1534a0333736ec5c7095450a
SSDEEP

12288:Cl2YX3TdtLW5WIj1YSSdFxsBSXyMzBUWb9lx/9AgHLo8OW+rBj:CkcDsj1dEcBcJ9nPx/igrp+1

Score

10^/10

Malware Config

Targets

- Target
  
  d8cab9f0e1d8aa81e904fd511fd4db06_JaffaCakes118
- Size
  
  657KB
- MD5
  
  d8cab9f0e1d8aa81e904fd511fd4db06
- SHA1
  
  c8f507e1184466db73e15d1ad73328b3a747c026
- SHA256
  
  3d99f295aeceacdb62e59c0728e3348f94a4261a1accbe672e3d04c9d7e2365a
- SHA512
  
  c0e094690be06e12937bd9b3279169864cf9066cd9b18449d36151a9704d13fa0c5caeb675358c1abcf1d78fc7431651a1b0211b1534a0333736ec5c7095450a
- SSDEEP
  
  12288:Cl2YX3TdtLW5WIj1YSSdFxsBSXyMzBUWb9lx/9AgHLo8OW+rBj:CkcDsj1dEcBcJ9nPx/igrp+1
Score

10^/10

discovery ardamax aspackv2 evasion keylogger persistence ransomware spyware stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Modifies WinLogon for persistence
  persistence
- Renames multiple (216) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2