ardamax | cb2915de4c762f5f65ec20e6d03dfd863a709eb3567c2a80e85f0175a9e8011e | Triage

Sharing

General

Target

JaffaCakes118_c8b2f08bceed7c5b3e784f17d8ccb14a
Size

480KB
Sample

250208-3m89cszkfq
MD5

c8b2f08bceed7c5b3e784f17d8ccb14a
SHA1

ada87bc979c4d3ca015748f0b92f844805dc6b8d
SHA256

cb2915de4c762f5f65ec20e6d03dfd863a709eb3567c2a80e85f0175a9e8011e
SHA512

a6a7fa225a559e4e066b29a9915b44a2fbce1a85540fb78aba62ddae3e397d27b189a06f27f60be7fdc422bb59fbb028f0cde3101820a4c4294be7c5b08c9eab
SSDEEP

12288:ECsNwizz2rVB6/xmQ6fnCR+xJbgApTJdeB61lwDRRjPA:gyizCIETGGJbgMFsNRbA

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  JaffaCakes118_c8b2f08bceed7c5b3e784f17d8ccb14a
- Size
  
  480KB
- MD5
  
  c8b2f08bceed7c5b3e784f17d8ccb14a
- SHA1
  
  ada87bc979c4d3ca015748f0b92f844805dc6b8d
- SHA256
  
  cb2915de4c762f5f65ec20e6d03dfd863a709eb3567c2a80e85f0175a9e8011e
- SHA512
  
  a6a7fa225a559e4e066b29a9915b44a2fbce1a85540fb78aba62ddae3e397d27b189a06f27f60be7fdc422bb59fbb028f0cde3101820a4c4294be7c5b08c9eab
- SSDEEP
  
  12288:ECsNwizz2rVB6/xmQ6fnCR+xJbgApTJdeB61lwDRRjPA:gyizCIETGGJbgMFsNRbA
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer