Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

22ec43703a...4c.exe

windows7-x64

10

22ec43703a...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22ec43703a0abfe2bba89ecd0f7a6f4d128aea3751226981339486897c3e4c4c

  • Size

    448KB

  • Sample

    250319-yjjr3s1wdw

  • MD5

    7a65b260b401540b5c18606ce470daa2

  • SHA1

    708fa40688033c63ddf067bf1882602303a794da

  • SHA256

    22ec43703a0abfe2bba89ecd0f7a6f4d128aea3751226981339486897c3e4c4c

  • SHA512

    1ae10601c1e95924f0275c6628a3698467eaac7eb79110d75cbbe7087092e0713f9c74154bd82f85e3b9ebff8e71df9a312ee2cdf657a0c72ddb664db6844af8

  • SSDEEP

    6144:ARQvKY+tJ+ov44Ku9CiWUvkyqfzR0Obvow4rsC7TkZcjdQjhYGvyK/1Tt/Im7:tK+ov44t5VGzRXesOR0p1Tt/IU

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      22ec43703a0abfe2bba89ecd0f7a6f4d128aea3751226981339486897c3e4c4c

    • Size

      448KB

    • MD5

      7a65b260b401540b5c18606ce470daa2

    • SHA1

      708fa40688033c63ddf067bf1882602303a794da

    • SHA256

      22ec43703a0abfe2bba89ecd0f7a6f4d128aea3751226981339486897c3e4c4c

    • SHA512

      1ae10601c1e95924f0275c6628a3698467eaac7eb79110d75cbbe7087092e0713f9c74154bd82f85e3b9ebff8e71df9a312ee2cdf657a0c72ddb664db6844af8

    • SSDEEP

      6144:ARQvKY+tJ+ov44Ku9CiWUvkyqfzR0Obvow4rsC7TkZcjdQjhYGvyK/1Tt/Im7:tK+ov44t5VGzRXesOR0p1Tt/IU

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks