Extracted

• • Target

    91c0ed616170401a29cd6fa0a59d0aede1d39d38ed1ce8485a6e6f5789da6454

  • Size

    600KB

  • MD5

    788e554c0938109f4ec5cb40af7bd228

  • SHA1

    62709ae17f8bdc45d5afae2fee3b954aed9005a0

  • SHA256

    91c0ed616170401a29cd6fa0a59d0aede1d39d38ed1ce8485a6e6f5789da6454

  • SHA512

    93670d12a873650f94d5d55e09f51ceab2db50e18d1a217a4a0e938cc786cbaed1b534ee55bf92c95d46c45b6a226d37608aa6d820caa814b592f88a8c1ab027

  • SSDEEP

    12288:fRhzupXfGlLO5MKsTDqtOotOBuI9NxpyLnZg:Zhz+ulKJS2PtmuSNxULZ

  Score

  10^/10

  ardamaxdiscoverykeyloggerpersistencestealer

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax family

    ardamax

  • Ardamax main executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2