Skip to main content

SpyTool.Win32.Ardamax_7b5d115512


not-a-virus:Monitor.Win32.Ardamax.dqq (Kaspersky), Gen:Variant.Application.Keylogger.Ardamax.6 (B) (Emsisoft), Gen:Variant.Application.Keylogger.Ardamax.6 (AdAware), SpyTool.Win32.Ardamax.FD, GenericEmailWorm.YR (Lavasoft MAS)Behaviour: Keylogger, Worm, EmailWorm, Monitor, SpyTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 7b5d1155122213826a98d4e538c674c5

SHA1: beeea5be8cedeb94f7c44e1fed51c602a8d72644

SHA256: c701a5ed8ff225c8762e7492d39d79e37cd28a0b10a0a4adb84760d155149fe1

SSDeep: 49152:EwSfClLrqLeaI1Xw3FMRHK3ZfWsTf9ppnT z3uzKLzWjgR3 Bu2CUEZB6EV57Trf:SfClSq11QFMQcsTlPTRzKLzWjgR3 Bux

Size: 2499072 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-04-03 01:46:49

Analyzed on: WindowsXP SP3 32-bit

Summary: SpyTool. A program used to apply passive protection methods to spyware, such as obfuscation, encryption or polymorphism. The original malicious program is usually encrypted/compressed and stored inside the wrapper.

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.


Process activity

The SpyTool creates the following process(es):No processes have been created.The SpyTool injects its code into the following process(es):

%original file name%.exe:112

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:112 makes changes in the file system.


The SpyTool creates and/or writes to the following file(s):

C:\7b5d1155122213826a98d4e538c674c5.01 (82 bytes)
C:\7b5d1155122213826a98d4e538c674c5.02 (56 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Аrdаmаx Keylogger 4.1.2\Аrdаmаx Keylogger 4.1.2.lnk (587 bytes)

Registry activity

The process %original file name%.exe:112 makes changes in the system registry.


The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 66 39 A1 60 E6 9E AB AE 61 74 0D F3 27 1E DF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Аrdаmаx Keylogger 4.1.2]
"UninstallString" = "c:\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Аrdаmаx Keylogger 4.1.2]
"DisplayName" = "Аrdаmаx Keylogger 4.1.2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

To automatically run itself each time Windows is booted, the SpyTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"7b5d1155122213826a98d4e538c674c5 Start" = "c:\%original file name%.exe"

Dropped PE files

MD5 File path
8010d4714f64764928956b21568e51fec:\7b5d1155122213826a98d4e538c674c5.01
a2350fa861b0eb50eeade64e82b2bdc6c:\7b5d1155122213826a98d4e538c674c5.02

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text4096123918612395524.803045a3eeee7a9cf64a50b798b40cf7bcfc5
.rdata12451843987143988483.81607e19ca9031c3eca37b94c1d7be778cc7d
.data1646592286752768003.048484cc39ba7684fa1e12010f01c46ea7837
.rsrc19374087827887828484.96436796fd64cd2d99a029ddd82629bc23ad9

Dropped from:

fe08953244f2642740985ea2f3d7d1c4382b64f7ef62b7a62863a1561b86693e

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 1
1b8f0ba159ba8b09232a877337c50524

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The SpyTool connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_112:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

Vh%D@

Vh%D@

udPh

udPh

Sh,%S

Sh,%S

PSSSSSSh

PSSSSSSh

PSSSSSSh!

PSSSSSSh!

@0,%S

@0,%S

vSSSh

vSSSh

FTPjK

FTPjK

FtPj;

FtPj;

C.PjRV

C.PjRV

tGHt.Ht&

tGHt.Ht&

.EKSWU

.EKSWU

FTPG

FTPG

FTPj

FTPj

FtPS

FtPS

=KNILw.tT=RCNEw

=KNILw.tT=RCNEw

_0 _8 _4;_,

_0 _8 _4;_,

SHA1 block transform for x86, CRYPTOGAMS by <appro></appro>

SHA1 block transform for x86, CRYPTOGAMS by <appro></appro>

SHA256 block transform for x86, CRYPTOGAMS by <appro></appro>

SHA256 block transform for x86, CRYPTOGAMS by <appro></appro>

DlSHA512 block transform for x86, CRYPTOGAMS by <appro></appro>

DlSHA512 block transform for x86, CRYPTOGAMS by <appro></appro>

Montgomery Multiplication for x86, CRYPTOGAMS by <appro></appro>

Montgomery Multiplication for x86, CRYPTOGAMS by <appro></appro>

6-9'6-9'

6-9'6-9'

$6.:$6.:

$6.:$6.:

*?#1*?#1

*?#1*?#1

>8$4,8$4,

>8$4,8$4,

AES for x86, CRYPTOGAMS by <appro></appro>

AES for x86, CRYPTOGAMS by <appro></appro>

Camellia for x86 by <appro></appro>

Camellia for x86 by <appro></appro>

RC4 for x86, CRYPTOGAMS by <appro></appro>

RC4 for x86, CRYPTOGAMS by <appro></appro>

FRegDeleteKeyExW

FRegDeleteKeyExW

MARGIN-BOTTOM: 11px; BORDER-STYLE: solid; BORDER-COLOR: #DFDFE5; BORDER-WIDTH: 2px; BACKGROUND-COLOR: #DFDFE5; }H2 { COLOR: black; BACKGROUND-COLOR: #FFFFF; FONT-SIZE: 12pt; FONT-WEIGHT: normal; MARGIN-BOTTOM: 0px; MARGIN-TOP: 10px;}