ardamax | 19db7102c31302f10d02116d3656183b02604b821cbd18efa456c9191d11f190 | Triage

Submit
Reports

Overview

overview

Static

static

3

4399d5c591...18.exe

windows7-x64

4399d5c591...18.exe

windows10-2004-x64

Sharing

General

Target

4399d5c5913aef60bc2245669f36b7b1_JaffaCakes118
Size

553KB
Sample

241014-w5drvatdmq
MD5

4399d5c5913aef60bc2245669f36b7b1
SHA1

edc091624e7928d45b9a5f6a1d75576e02e686dd
SHA256

19db7102c31302f10d02116d3656183b02604b821cbd18efa456c9191d11f190
SHA512

1c71288cead4d78ea735dc3fade8cbcfe7fea08106fe16bf350f1b5edccdbe72c8911ae8b83b295655a10cc1a8f186f3f063347d62178c20881148d7fa71a322
SSDEEP

12288:phaCEJNB7Yn82wZIASOK50GcL1CSZcBuOzdsudtax/wqmhdcydK1F5:pwCINBMHwZIHOGM1ChhNfaxb0pKR

Score

10^/10

ardamax bootkit discovery keylogger persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4399d5c5913aef60bc2245669f36b7b1_JaffaCakes118.exe

Resource

win7-20240729-en

ardamax bootkit discovery keylogger persistence stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

4399d5c5913aef60bc2245669f36b7b1_JaffaCakes118.exe

Resource

win10v2004-20241007-en

ardamax discovery keylogger stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  4399d5c5913aef60bc2245669f36b7b1_JaffaCakes118
- Size
  
  553KB
- MD5
  
  4399d5c5913aef60bc2245669f36b7b1
- SHA1
  
  edc091624e7928d45b9a5f6a1d75576e02e686dd
- SHA256
  
  19db7102c31302f10d02116d3656183b02604b821cbd18efa456c9191d11f190
- SHA512
  
  1c71288cead4d78ea735dc3fade8cbcfe7fea08106fe16bf350f1b5edccdbe72c8911ae8b83b295655a10cc1a8f186f3f063347d62178c20881148d7fa71a322
- SSDEEP
  
  12288:phaCEJNB7Yn82wZIASOK50GcL1CSZcBuOzdsudtax/wqmhdcydK1F5:pwCINBMHwZIHOGM1ChhNfaxb0pKR
Score

10^/10

ardamax bootkit discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxbootkitdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy