ardamax | e842fe993f175f111fd6799907f2fb42956766e03c51b1397263f1922f3c3aeb | Triage

Submit
Reports

Overview

overview

Static

static

3

001950ed5a...18.exe

windows7-x64

001950ed5a...18.exe

windows10-2004-x64

Sharing

General

Target

001950ed5a6d66308ae1fb1782ddea42_JaffaCakes118
Size

187KB
Sample

240930-hxzsfswfpd
MD5

001950ed5a6d66308ae1fb1782ddea42
SHA1

794343bbc42718c10b7aff927de5d6f9264e123c
SHA256

e842fe993f175f111fd6799907f2fb42956766e03c51b1397263f1922f3c3aeb
SHA512

512306e23f04fa45af213a28939f8d5708fc96035b918a29db634355a571e7f355a8c3cd8d4af7644d2d548787b14f0fcb4e6b71038b90a791b9335f034c84de
SSDEEP

3072:7CNmpyGKj6KpZZUCnkAKrM2SkF1vHrqkjoZEuOfnhIAkrdhiMYW1gU3r0GMzk:0mpyGKuKpZGCkAB2fTHrFkZEuOf3kBht

Score

10^/10

ardamax discovery keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

001950ed5a6d66308ae1fb1782ddea42_JaffaCakes118.exe

Resource

win7-20240729-en

ardamax discovery keylogger stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

001950ed5a6d66308ae1fb1782ddea42_JaffaCakes118.exe

Resource

win10v2004-20240802-en

ardamax discovery keylogger stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  001950ed5a6d66308ae1fb1782ddea42_JaffaCakes118
- Size
  
  187KB
- MD5
  
  001950ed5a6d66308ae1fb1782ddea42
- SHA1
  
  794343bbc42718c10b7aff927de5d6f9264e123c
- SHA256
  
  e842fe993f175f111fd6799907f2fb42956766e03c51b1397263f1922f3c3aeb
- SHA512
  
  512306e23f04fa45af213a28939f8d5708fc96035b918a29db634355a571e7f355a8c3cd8d4af7644d2d548787b14f0fcb4e6b71038b90a791b9335f034c84de
- SSDEEP
  
  3072:7CNmpyGKj6KpZZUCnkAKrM2SkF1vHrqkjoZEuOfnhIAkrdhiMYW1gU3r0GMzk:0mpyGKuKpZGCkAB2fTHrFkZEuOf3kBht
Score

10^/10

ardamax discovery keylogger stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerstealer

behavioral2

ardamaxdiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy