ardamax | 9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6c | Triage

Submit
Reports

Overview

overview

Static

static

3

9bacf2080d...cN.exe

windows7-x64

9bacf2080d...cN.exe

windows10-2004-x64

3

Sharing

General

Target

9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6cN
Size

652KB
Sample

241014-rjsawstbml
MD5

2abbe2435b80358655c93cb5a388b790
SHA1

5002eca05b476d2e38f75a6ae19e88e4cc11c7d8
SHA256

9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6c
SHA512

f7aadb2aa71eaf7a63501131a54db264ab8f7d87cfd98a6e04ecd21a26cb7189f134b297a9b02da27f8cff9fa205c1d7d774f6317f7df7cb8947404c31340d4e
SSDEEP

12288:cyKlsEr9jVYSBPcZFwcomlgz4cJdiXG5akRXYcFTI5vjCXK4COYO93W:cfjVYSheomqz/5PRIcFTyvtfO8

Score

10^/10

ardamax discovery keylogger persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6cN.exe

Resource

win7-20240903-en

ardamax discovery keylogger persistence stealer

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6cN.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

120 seconds

Malware Config

Targets

- Target
  
  9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6cN
- Size
  
  652KB
- MD5
  
  2abbe2435b80358655c93cb5a388b790
- SHA1
  
  5002eca05b476d2e38f75a6ae19e88e4cc11c7d8
- SHA256
  
  9bacf2080d71c340c34b0865b33795925da1d52f96786160cd56e64e5503ab6c
- SHA512
  
  f7aadb2aa71eaf7a63501131a54db264ab8f7d87cfd98a6e04ecd21a26cb7189f134b297a9b02da27f8cff9fa205c1d7d774f6317f7df7cb8947404c31340d4e
- SSDEEP
  
  12288:cyKlsEr9jVYSBPcZFwcomlgz4cJdiXG5akRXYcFTI5vjCXK4COYO93W:cfjVYSheomqz/5PRIcFTyvtfO8
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

© 2018-2025

Terms | Privacy