ardamax | d2b82aceb0fefc61e61988de6642e38e8a43794bc7eace500b543a30d2dbbc77 | Triage

Sharing

General

Target

JaffaCakes118_fc55485263d7bdc6e4a3adf3b83bde6d
Size

599KB
Sample

250215-zkjzxatnfy
MD5

fc55485263d7bdc6e4a3adf3b83bde6d
SHA1

bf6180b84513aa6800fde62d514e64be77e21d7a
SHA256

d2b82aceb0fefc61e61988de6642e38e8a43794bc7eace500b543a30d2dbbc77
SHA512

c350ff934b018cdd0ff1962f9c518eba4a90f8159e397fe2c6724fcd0b0173d7573514842ef73b5ed34b1a1d521ad7c9ff4d2ff10c09bd135e021eff5af3d7c0
SSDEEP

12288:+demUOhFb8yUEbU1X8uclpixBspAOUdk/I+QRoP5O:zmUOhZ8ys1sucvSMUdYl4

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  JaffaCakes118_fc55485263d7bdc6e4a3adf3b83bde6d
- Size
  
  599KB
- MD5
  
  fc55485263d7bdc6e4a3adf3b83bde6d
- SHA1
  
  bf6180b84513aa6800fde62d514e64be77e21d7a
- SHA256
  
  d2b82aceb0fefc61e61988de6642e38e8a43794bc7eace500b543a30d2dbbc77
- SHA512
  
  c350ff934b018cdd0ff1962f9c518eba4a90f8159e397fe2c6724fcd0b0173d7573514842ef73b5ed34b1a1d521ad7c9ff4d2ff10c09bd135e021eff5af3d7c0
- SSDEEP
  
  12288:+demUOhFb8yUEbU1X8uclpixBspAOUdk/I+QRoP5O:zmUOhZ8ys1sucvSMUdYl4
Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer