ardamax | 7ec515b39707ff745b04a84ad8b54693f3ebfe257916b7aa493d4af6dc7b5ade | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

cf712e0e1b...18.exe

windows7-x64

cf712e0e1b...18.exe

windows10-2004-x64

Sharing

General

Target

cf712e0e1b007039477b42d9bc3d0f41_JaffaCakes118
Size

1.5MB
Sample

240906-ns2zxavcne
MD5

cf712e0e1b007039477b42d9bc3d0f41
SHA1

c717859e2db94f568f32d5f3577ca34b5fa6e694
SHA256

7ec515b39707ff745b04a84ad8b54693f3ebfe257916b7aa493d4af6dc7b5ade
SHA512

178bbc4e3b89ae16336b38f8f487dd2f282201852bfc41930598f157e3d42b6c036a3917643180a58e365f3f4350a7434accf84b0896cef8066bb0df2987a68f
SSDEEP

24576:+DrTWoILNUc0Hy9wA9YhAnCnwmG0hMJ2klg+mG/fySYLKOl8v3dGIfADD9l1x:+XTZWNWyyAWywwjwCg+dTMK6gNGIaD3

Score

10^/10

ardamax discovery keylogger persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

cf712e0e1b007039477b42d9bc3d0f41_JaffaCakes118.exe

Resource

win7-20240704-en

ardamax discovery keylogger persistence stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

cf712e0e1b007039477b42d9bc3d0f41_JaffaCakes118.exe

Resource

win10v2004-20240802-en

ardamax discovery keylogger persistence stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  cf712e0e1b007039477b42d9bc3d0f41_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  cf712e0e1b007039477b42d9bc3d0f41
- SHA1
  
  c717859e2db94f568f32d5f3577ca34b5fa6e694
- SHA256
  
  7ec515b39707ff745b04a84ad8b54693f3ebfe257916b7aa493d4af6dc7b5ade
- SHA512
  
  178bbc4e3b89ae16336b38f8f487dd2f282201852bfc41930598f157e3d42b6c036a3917643180a58e365f3f4350a7434accf84b0896cef8066bb0df2987a68f
- SSDEEP
  
  24576:+DrTWoILNUc0Hy9wA9YhAnCnwmG0hMJ2klg+mG/fySYLKOl8v3dGIfADD9l1x:+XTZWNWyyAWywwjwCg+dTMK6gNGIaD3
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer

© 2018-2025

Terms | Privacy