ardamax

General

Target

ff9f446a4af23885d757067139d209f5_JaffaCakes118
Size

1.4MB
Sample

240930-a9jm1aygqj
MD5

ff9f446a4af23885d757067139d209f5
SHA1

b55ca8bb0ee963b30a7e95db122e8544fe94a909
SHA256

a2e197c6ace5e247762e2d1c22a7c32632a9f1782655926f59848334ea8a614f
SHA512

eaf626ab69595c6c449e6ac46a82199f16e43a66726c22ebe892072eb64ef103abdac6960b1baa89c2b8174aa1ee1452468cb891e1ab32c350ba843f9ea2a047
SSDEEP

24576:sz+fCyfGk7wLbXiHLw4r6PZVxm6xyDCe7FriwK1M/OEXSpATadlQ/gDePz4ARhKI:sqfC4GJCWx/mLfFW310V/gDfG1RXkaoe

Score

10^/10

Malware Config

Targets

- Target
  
  ff9f446a4af23885d757067139d209f5_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  ff9f446a4af23885d757067139d209f5
- SHA1
  
  b55ca8bb0ee963b30a7e95db122e8544fe94a909
- SHA256
  
  a2e197c6ace5e247762e2d1c22a7c32632a9f1782655926f59848334ea8a614f
- SHA512
  
  eaf626ab69595c6c449e6ac46a82199f16e43a66726c22ebe892072eb64ef103abdac6960b1baa89c2b8174aa1ee1452468cb891e1ab32c350ba843f9ea2a047
- SSDEEP
  
  24576:sz+fCyfGk7wLbXiHLw4r6PZVxm6xyDCe7FriwK1M/OEXSpATadlQ/gDePz4ARhKI:sqfC4GJCWx/mLfFW310V/gDfG1RXkaoe
Score

10^/10

ardamax discovery keylogger stealer themida
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ardamax main executable

Deletes itself

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2