ardamax | 666dd258fbca3da5ac131987029f921d173d53bef603610ea71bcc8ea42f55ae | Triage

Sharing

General

Target

JaffaCakes118_c635a19fcd7477b3dee32b5aafca1e3a
Size

1.3MB
Sample

250208-xe665szmaj
MD5

c635a19fcd7477b3dee32b5aafca1e3a
SHA1

01948ce3f524126218072b1411f04884c7eff7d6
SHA256

666dd258fbca3da5ac131987029f921d173d53bef603610ea71bcc8ea42f55ae
SHA512

87bb4a4524bc3da50b9a4a35a6a1ee8cdd8e2c76041db7247c23764a44f4d1d39e258bb2b264fa9dff402d3bb3866d1d019335e9f93f658ad411083e20da2cc5
SSDEEP

24576:D64MVTqaqCQRyzYLFNIXkLbbE2P7XK8HyoM8h02smgii5YlxJQp6w1I5LOftGQ:D64MTqaqCv2IU/ogfJM8hZfnQYnJY1I

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  JaffaCakes118_c635a19fcd7477b3dee32b5aafca1e3a
- Size
  
  1.3MB
- MD5
  
  c635a19fcd7477b3dee32b5aafca1e3a
- SHA1
  
  01948ce3f524126218072b1411f04884c7eff7d6
- SHA256
  
  666dd258fbca3da5ac131987029f921d173d53bef603610ea71bcc8ea42f55ae
- SHA512
  
  87bb4a4524bc3da50b9a4a35a6a1ee8cdd8e2c76041db7247c23764a44f4d1d39e258bb2b264fa9dff402d3bb3866d1d019335e9f93f658ad411083e20da2cc5
- SSDEEP
  
  24576:D64MVTqaqCQRyzYLFNIXkLbbE2P7XK8HyoM8h02smgii5YlxJQp6w1I5LOftGQ:D64MTqaqCv2IU/ogfJM8hZfnQYnJY1I
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer