Overview

overview

10

Static

static

3

248b3b391b...aN.exe

windows7-x64

10

248b3b391b...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    248b3b391b25c1fbbc5b2fdfca9d188d0d1f4b85ce16d0f3ff9ee16d84d874aaN

  • Size

    1.1MB

  • Sample

    241019-km5l3axbma

  • MD5

    3e52b3ed48a7b30aa1448eeb1a3fd080

  • SHA1

    8cb8d85effbdd46dba6fa2435ef70c210d6ab82a

  • SHA256

    248b3b391b25c1fbbc5b2fdfca9d188d0d1f4b85ce16d0f3ff9ee16d84d874aa

  • SHA512

    8e564585a987f59969d532ce8c17a9ab52ee13b7749d47a339c5e2f9999f8a8d4314a8c3a6c844431cbbeb06338184caefff499dfc861ab4e98a3872c23fdb7d

  • SSDEEP

    24576:uk/ATFxCl4DLOHSwPAkhiOWTvL6EMs7Otc/AoLfhRi0VZ1P55ksmC9pCt:voTFxCl4gD+XX6Nsq6z5ffklip

Score
10/10
ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      248b3b391b25c1fbbc5b2fdfca9d188d0d1f4b85ce16d0f3ff9ee16d84d874aaN

    • Size

      1.1MB

    • MD5

      3e52b3ed48a7b30aa1448eeb1a3fd080

    • SHA1

      8cb8d85effbdd46dba6fa2435ef70c210d6ab82a

    • SHA256

      248b3b391b25c1fbbc5b2fdfca9d188d0d1f4b85ce16d0f3ff9ee16d84d874aa

    • SHA512

      8e564585a987f59969d532ce8c17a9ab52ee13b7749d47a339c5e2f9999f8a8d4314a8c3a6c844431cbbeb06338184caefff499dfc861ab4e98a3872c23fdb7d

    • SSDEEP

      24576:uk/ATFxCl4DLOHSwPAkhiOWTvL6EMs7Otc/AoLfhRi0VZ1P55ksmC9pCt:voTFxCl4gD+XX6Nsq6z5ffklip

    Score
    10/10
    ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks