ardamax | 48d08800b37074bfb617173dfff1abee3d8af2a15822151653af8d25442966a2 | Triage

Submit
Reports

Overview

overview

Static

static

3

e7930aa311...18.exe

windows7-x64

e7930aa311...18.exe

windows10-2004-x64

Sharing

General

Target

e7930aa3119849de70ac9cd5f974211f_JaffaCakes118
Size

359KB
Sample

240408-qt9r9adf6w
MD5

e7930aa3119849de70ac9cd5f974211f
SHA1

19de0ae686e69e1563b865797b00f7e3d209b263
SHA256

48d08800b37074bfb617173dfff1abee3d8af2a15822151653af8d25442966a2
SHA512

b1028a86477a64c4a1f98bbed9f5a1789cbb337df1bb47fac7c25d5d72201a7679e061856fdff94e72706fe8efc222d72eeecb781bc8720f31a4c0c2586f4835
SSDEEP

6144:Kb99ZwNPbgI/ZpVCF0nkYMdZCZkN5I0LfGClTDZVbFmdJROewS6A/g2oQEW:OfZw/plkY2C6DI0zlB6jOep5R

Score

10^/10

ardamax discovery keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e7930aa3119849de70ac9cd5f974211f_JaffaCakes118.exe

Resource

win7-20231129-en

ardamax discovery keylogger stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

e7930aa3119849de70ac9cd5f974211f_JaffaCakes118.exe

Resource

win10v2004-20231215-en

ardamax discovery keylogger stealer

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  e7930aa3119849de70ac9cd5f974211f_JaffaCakes118
- Size
  
  359KB
- MD5
  
  e7930aa3119849de70ac9cd5f974211f
- SHA1
  
  19de0ae686e69e1563b865797b00f7e3d209b263
- SHA256
  
  48d08800b37074bfb617173dfff1abee3d8af2a15822151653af8d25442966a2
- SHA512
  
  b1028a86477a64c4a1f98bbed9f5a1789cbb337df1bb47fac7c25d5d72201a7679e061856fdff94e72706fe8efc222d72eeecb781bc8720f31a4c0c2586f4835
- SSDEEP
  
  6144:Kb99ZwNPbgI/ZpVCF0nkYMdZCZkN5I0LfGClTDZVbFmdJROewS6A/g2oQEW:OfZw/plkY2C6DI0zlB6jOep5R
Score

10^/10

ardamax discovery keylogger stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerstealer

behavioral2

ardamaxdiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy