ardamax | ce374345ae6308cd299882d3108ed32d3c53a4b7bf61b359e587dc06d43f6fd4 | Triage

Submit
Reports

Overview

overview

Static

static

7

d49e7fe0d0...18.exe

windows7-x64

d49e7fe0d0...18.exe

windows10-2004-x64

3

Sharing

General

Target

d49e7fe0d0899b6567575440384a3427_JaffaCakes118
Size

2.1MB
Sample

240908-scj7davbrh
MD5

d49e7fe0d0899b6567575440384a3427
SHA1

ff40f3a782140c0e10cd774a659e7712262b7359
SHA256

ce374345ae6308cd299882d3108ed32d3c53a4b7bf61b359e587dc06d43f6fd4
SHA512

1c7979378970dd206f35dfe261a785330177207e52fe0f00719fe5acffd0dfd7c194e3a0c712edd0b384529493f54d56220582864aa880d394fba70952dfe313
SSDEEP

24576:O5/QZs3lTfpZ/YzqsTJG0KmnFDNw6yX+DA5ZmDSvcBcLCEqLsYp1srjXzRTPlIod:7OFQ9bnzqOE+G3WsjPM0bf1YBjMKC

Score

10^/10

ardamax discovery keylogger persistence stealer themida

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

d49e7fe0d0899b6567575440384a3427_JaffaCakes118.exe

Resource

win7-20240708-en

ardamax discovery keylogger persistence stealer themida

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

d49e7fe0d0899b6567575440384a3427_JaffaCakes118.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  d49e7fe0d0899b6567575440384a3427_JaffaCakes118
- Size
  
  2.1MB
- MD5
  
  d49e7fe0d0899b6567575440384a3427
- SHA1
  
  ff40f3a782140c0e10cd774a659e7712262b7359
- SHA256
  
  ce374345ae6308cd299882d3108ed32d3c53a4b7bf61b359e587dc06d43f6fd4
- SHA512
  
  1c7979378970dd206f35dfe261a785330177207e52fe0f00719fe5acffd0dfd7c194e3a0c712edd0b384529493f54d56220582864aa880d394fba70952dfe313
- SSDEEP
  
  24576:O5/QZs3lTfpZ/YzqsTJG0KmnFDNw6yX+DA5ZmDSvcBcLCEqLsYp1srjXzRTPlIod:7OFQ9bnzqOE+G3WsjPM0bf1YBjMKC
Score

10^/10

ardamax discovery keylogger persistence stealer themida
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealerthemida

behavioral2

© 2018-2025

Terms | Privacy