ardamax | 4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7 | Triage

Submit
Reports

Overview

overview

Static

static

3

4aa09fa052...7N.exe

windows7-x64

4aa09fa052...7N.exe

windows10-2004-x64

Sharing

General

Target

4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7N
Size

3.2MB
Sample

241012-xj8krswcje
MD5

0ac08d19b395d553f50168235f7c7ed0
SHA1

1a9b02b39fe52066db32e233b541f2b0db68cb23
SHA256

4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7
SHA512

9a65bad63e1da4a8d6c2567eb71733b318cb68f0eebbe6a1ef3eb0cbbea50b63a1649a80d6e5253de17964a3e3a7150dca5faef01c171bd95aacb5f4a26b7d9a
SSDEEP

98304:R57Up17aZGruoEinbe6xKpCxlronCUsvm:DweWuoDDKgxpoU

Score

10^/10

ardamax discovery keylogger link pdf persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7N.exe

Resource

win7-20241010-en

ardamax discovery keylogger link pdf persistence stealer

windows7-x64

11 signatures

120 seconds

Behavioral task

behavioral2

Sample

4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7N.exe

Resource

win10v2004-20241007-en

ardamax discovery keylogger link pdf persistence stealer

windows10-2004-x64

16 signatures

120 seconds

Malware Config

Targets

- Target
  
  4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7N
- Size
  
  3.2MB
- MD5
  
  0ac08d19b395d553f50168235f7c7ed0
- SHA1
  
  1a9b02b39fe52066db32e233b541f2b0db68cb23
- SHA256
  
  4aa09fa0529beb0d2096a1aa86cf4111cfff56b479a4048e8dcd13b937c7c0c7
- SHA512
  
  9a65bad63e1da4a8d6c2567eb71733b318cb68f0eebbe6a1ef3eb0cbbea50b63a1649a80d6e5253de17964a3e3a7150dca5faef01c171bd95aacb5f4a26b7d9a
- SSDEEP
  
  98304:R57Up17aZGruoEinbe6xKpCxlronCUsvm:DweWuoDDKgxpoU
Score

10^/10

ardamax discovery keylogger link pdf persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerlinkpdfpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerlinkpdfpersistencestealer

© 2018-2025

Terms | Privacy