ardamax

General

Target

JaffaCakes118_1d2adaabf198d26f9cb17e7afc873387
Size

2.3MB
Sample

250124-c3h41awrgp
MD5

1d2adaabf198d26f9cb17e7afc873387
SHA1

6d6501fa2475ccfaa049dea6b996dc757fdfc7b9
SHA256

a51e91ac7de75fb3a814387fb5f45948fa6afd2468db975fcda24889eb99c8a0
SHA512

0e9206e8c5e2adbdd9ee27f246cc951e96f4d3004501abbdcf6fa8ad88f7c2c055b73c4ffb5718b76f111d4bc9c1b5a5f35f7c45333eb87beaa1f793b495d4b9
SSDEEP

49152:Ux6h57Kp1amL0VUCrTASC0xsPDkCpFW7EDlCDcRE0hZPBEvPS:3p6LtwTASCfPDkEdDWeBB9

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_1d2adaabf198d26f9cb17e7afc873387
- Size
  
  2.3MB
- MD5
  
  1d2adaabf198d26f9cb17e7afc873387
- SHA1
  
  6d6501fa2475ccfaa049dea6b996dc757fdfc7b9
- SHA256
  
  a51e91ac7de75fb3a814387fb5f45948fa6afd2468db975fcda24889eb99c8a0
- SHA512
  
  0e9206e8c5e2adbdd9ee27f246cc951e96f4d3004501abbdcf6fa8ad88f7c2c055b73c4ffb5718b76f111d4bc9c1b5a5f35f7c45333eb87beaa1f793b495d4b9
- SSDEEP
  
  49152:Ux6h57Kp1amL0VUCrTASC0xsPDkCpFW7EDlCDcRE0hZPBEvPS:3p6LtwTASCfPDkEdDWeBB9
Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer themida upx
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Modifies WinLogon for persistence
  persistence
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2