ardamax | 19c776462269aad3ea7ddc0675ff0aefeeb4826e97c59a148d5c46563206836f | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

ab81cf40d0...18.exe

windows7-x64

ab81cf40d0...18.exe

windows10-2004-x64

Sharing

General

Target

ab81cf40d00a27ef7afc0499b785bfae_JaffaCakes118
Size

1.4MB
Sample

240819-slyfcsvcpm
MD5

ab81cf40d00a27ef7afc0499b785bfae
SHA1

3958d1863455e8c2ddb6635eacf9837458cb8c26
SHA256

19c776462269aad3ea7ddc0675ff0aefeeb4826e97c59a148d5c46563206836f
SHA512

a437e5dc1a17a2a34e2bbd7cb1f4cdbc6a884ec3d5b8ab54816f47ed96d22b027dc79d949ed218f55ec12544a23e74b992ac5a59f6b2c1e1da0f5ae9915dc219
SSDEEP

24576:Yk/AToFxsx/OlGI4B1kWOPJwCbCCWeV4bTpuYFNanoN7CIu6DQnm+INsSFkZVi:5oToFOGPCAwCbJWeVUumgRnm8SFkZV

Score

10^/10

ardamax discovery keylogger persistence stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ab81cf40d00a27ef7afc0499b785bfae_JaffaCakes118.exe

Resource

win7-20240705-en

ardamax discovery keylogger persistence stealer upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

ab81cf40d00a27ef7afc0499b785bfae_JaffaCakes118.exe

Resource

win10v2004-20240802-en

ardamax discovery keylogger persistence stealer upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  ab81cf40d00a27ef7afc0499b785bfae_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  ab81cf40d00a27ef7afc0499b785bfae
- SHA1
  
  3958d1863455e8c2ddb6635eacf9837458cb8c26
- SHA256
  
  19c776462269aad3ea7ddc0675ff0aefeeb4826e97c59a148d5c46563206836f
- SHA512
  
  a437e5dc1a17a2a34e2bbd7cb1f4cdbc6a884ec3d5b8ab54816f47ed96d22b027dc79d949ed218f55ec12544a23e74b992ac5a59f6b2c1e1da0f5ae9915dc219
- SSDEEP
  
  24576:Yk/AToFxsx/OlGI4B1kWOPJwCbCCWeV4bTpuYFNanoN7CIu6DQnm+INsSFkZVi:5oToFOGPCAwCbJWeVUumgRnm8SFkZV
Score

10^/10

ardamax discovery keylogger persistence stealer upx
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealerupx

behavioral2

ardamaxdiscoverykeyloggerpersistencestealerupx

© 2018-2025

Terms | Privacy