ardamax

General

Target

JaffaCakes118_8e5b677ce9f2667e863c291158775bb4
Size

932KB
Sample

250204-bfbkzazkat
MD5

8e5b677ce9f2667e863c291158775bb4
SHA1

b1806348fd174ea11c5b43bf5e8cbfed3ddb3fcd
SHA256

dc830c6e64c88ef9a70275308524f5d35325f297d97e4a24ae05dee2fbfba71e
SHA512

9aab6222c69626296cf8486e57dcd045125e91b5acf4d6697032c2830e7fd33b49cd77049b7549bc39260c9f006857fe1984afe7b277d4a294539eec195fb1e4
SSDEEP

24576:3gITlEib8hhvPlUGksxK3ilj7VjNK8ySVMViCe3C/jc:3R8hh3WTij7VjNlg18sjc

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_8e5b677ce9f2667e863c291158775bb4
- Size
  
  932KB
- MD5
  
  8e5b677ce9f2667e863c291158775bb4
- SHA1
  
  b1806348fd174ea11c5b43bf5e8cbfed3ddb3fcd
- SHA256
  
  dc830c6e64c88ef9a70275308524f5d35325f297d97e4a24ae05dee2fbfba71e
- SHA512
  
  9aab6222c69626296cf8486e57dcd045125e91b5acf4d6697032c2830e7fd33b49cd77049b7549bc39260c9f006857fe1984afe7b277d4a294539eec195fb1e4
- SSDEEP
  
  24576:3gITlEib8hhvPlUGksxK3ilj7VjNK8ySVMViCe3C/jc:3R8hh3WTij7VjNlg18sjc
Score

10^/10

ardamax discovery keylogger stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Ardamax family

Ardamax main executable

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2