ardamax | dd3abd447c9a2bf99c2afb7f0f1021b3fbb8e0726ad0f12936af4f98768ddc0e | Triage

Submit
Reports

Overview

overview

Static

static

3

19def6e65b...18.exe

windows7-x64

19def6e65b...18.exe

windows10-2004-x64

Sharing

General

Target

19def6e65be13e10c6a037f22e403d83_JaffaCakes118
Size

1.5MB
Sample

240628-m3kb6swbmc
MD5

19def6e65be13e10c6a037f22e403d83
SHA1

22b4ad342c237acbd8ae1ffbe93b0934eae33afa
SHA256

dd3abd447c9a2bf99c2afb7f0f1021b3fbb8e0726ad0f12936af4f98768ddc0e
SHA512

b11640638562ad862cea5cdbc84502738643fa14af12b39d9d917f2d260c5a5ee474feb95bb148ce9b37b68dcb040fcbb481f0a2f671f4fc92ef579299717c18
SSDEEP

24576:QDrTPRXSWAtrPpMxEqjP5GsXcKET1Vg04GaeqfGe6h+TiO8J+VGgq49zhx1RQnc7:QXTxSvp/q0sPET1Vg7Gaeqp6DOo+V4y1

Score

10^/10

ardamax discovery keylogger persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

19def6e65be13e10c6a037f22e403d83_JaffaCakes118.exe

Resource

win7-20240220-en

ardamax discovery keylogger persistence stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

19def6e65be13e10c6a037f22e403d83_JaffaCakes118.exe

Resource

win10v2004-20240508-en

ardamax discovery keylogger persistence stealer

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  19def6e65be13e10c6a037f22e403d83_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  19def6e65be13e10c6a037f22e403d83
- SHA1
  
  22b4ad342c237acbd8ae1ffbe93b0934eae33afa
- SHA256
  
  dd3abd447c9a2bf99c2afb7f0f1021b3fbb8e0726ad0f12936af4f98768ddc0e
- SHA512
  
  b11640638562ad862cea5cdbc84502738643fa14af12b39d9d917f2d260c5a5ee474feb95bb148ce9b37b68dcb040fcbb481f0a2f671f4fc92ef579299717c18
- SSDEEP
  
  24576:QDrTPRXSWAtrPpMxEqjP5GsXcKET1Vg04GaeqfGe6h+TiO8J+VGgq49zhx1RQnc7:QXTxSvp/q0sPET1Vg7Gaeqp6DOo+V4y1
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer

© 2018-2025

Terms | Privacy