ardamax | 0e039b353d84e6aa1dc31a3dc854a8926c5d9f8a27cddf21dffabad7d440bf52 | Triage

Sharing

General

Target

JaffaCakes118_bab1aed55fbfbfcac6c404299b651053
Size

956KB
Sample

250207-yb12dsvqhp
MD5

bab1aed55fbfbfcac6c404299b651053
SHA1

6886d6432f2371499ba8a58e993feb3341c66fab
SHA256

0e039b353d84e6aa1dc31a3dc854a8926c5d9f8a27cddf21dffabad7d440bf52
SHA512

cca801f0a810ca44d379eacccc670f0831a7d96f9aba621a8e30d8255481782beb839d8c431317bfb82dc9b81d9688147d86e19cddded6e54656341a9452cc77
SSDEEP

24576:FzwTT6vYvVnFqSdWWFdgf8G7kA4wFPx1kp3qt3zbMAZhg2iL2LRJg:Fz+TfzUWEfFP4wd+g30gN

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  JaffaCakes118_bab1aed55fbfbfcac6c404299b651053
- Size
  
  956KB
- MD5
  
  bab1aed55fbfbfcac6c404299b651053
- SHA1
  
  6886d6432f2371499ba8a58e993feb3341c66fab
- SHA256
  
  0e039b353d84e6aa1dc31a3dc854a8926c5d9f8a27cddf21dffabad7d440bf52
- SHA512
  
  cca801f0a810ca44d379eacccc670f0831a7d96f9aba621a8e30d8255481782beb839d8c431317bfb82dc9b81d9688147d86e19cddded6e54656341a9452cc77
- SSDEEP
  
  24576:FzwTT6vYvVnFqSdWWFdgf8G7kA4wFPx1kp3qt3zbMAZhg2iL2LRJg:Fz+TfzUWEfFP4wd+g30gN
Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer