ardamax | c9fe3c4f7a956a4b6696141dcf9d7f0a901bb93389581222543af3d7f0e40b37 | Triage

Submit
Reports

Overview

overview

Static

static

3

01112e9bc6...18.exe

windows7-x64

01112e9bc6...18.exe

windows10-2004-x64

Sharing

General

Target

01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118
Size

270KB
Sample

240930-nhxx7ssekn
MD5

01112e9bc69881fc7370c2ec08f5afe9
SHA1

d05a36a8bbe06cdbc81ce9d02f4bd43b89c72c1a
SHA256

c9fe3c4f7a956a4b6696141dcf9d7f0a901bb93389581222543af3d7f0e40b37
SHA512

80584564e9637a99414cf124651b0e043af0ce56b244bc612b6bc0ac593fd9af9ceb24b54964d5a6acd11679e70e0cc49e2a2bf2d2bbf08cbb8cfcb061159a93
SSDEEP

6144:G92Og70tpbRvY+yNJ9YK7eBlohQC1TEBUyJTzMBOBbp9OFZ2uh:G9aKbRhSsIez4cJTIMVSjZh

Score

10^/10

ardamax discovery keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe

Resource

win7-20240708-en

ardamax discovery keylogger stealer

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe

Resource

win10v2004-20240802-en

ardamax discovery keylogger stealer

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118
- Size
  
  270KB
- MD5
  
  01112e9bc69881fc7370c2ec08f5afe9
- SHA1
  
  d05a36a8bbe06cdbc81ce9d02f4bd43b89c72c1a
- SHA256
  
  c9fe3c4f7a956a4b6696141dcf9d7f0a901bb93389581222543af3d7f0e40b37
- SHA512
  
  80584564e9637a99414cf124651b0e043af0ce56b244bc612b6bc0ac593fd9af9ceb24b54964d5a6acd11679e70e0cc49e2a2bf2d2bbf08cbb8cfcb061159a93
- SSDEEP
  
  6144:G92Og70tpbRvY+yNJ9YK7eBlohQC1TEBUyJTzMBOBbp9OFZ2uh:G9aKbRhSsIez4cJTIMVSjZh
Score

10^/10

ardamax discovery keylogger stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerstealer

behavioral2

ardamaxdiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy