ardamax | d9f9b12f1ecc9bbcc8d5eef4f12978163ff31968ee4391840ad99739cc6aebeb | Triage

Submit
Reports

Overview

overview

Static

static

3

b355c411a2...18.exe

windows7-x64

b355c411a2...18.exe

windows10-2004-x64

Sharing

General

Target

b355c411a253c37f48d84aac1040c20f_JaffaCakes118
Size

610KB
Sample

241129-y1wg7symam
MD5

b355c411a253c37f48d84aac1040c20f
SHA1

0334fde6af352c24fe91432413e7aa14dd24abf3
SHA256

d9f9b12f1ecc9bbcc8d5eef4f12978163ff31968ee4391840ad99739cc6aebeb
SHA512

3202bd6b6c795a9a22c10db9d64b0222884d24964abf1495f3bb348c83e397dab41dc9d252fcbb7e4be3050e118cec6c6c5714283bd080c69ddcc80c13e63d61
SSDEEP

12288:vQHBLPUakcWb7ewCTpO6ekNyz0Ie8kgOLQZEYhQBVfI3795vx7O:vQHBLPJnWb70TyAF8VZ3QBS377x7O

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b355c411a253c37f48d84aac1040c20f_JaffaCakes118.exe

Resource

win7-20240903-en

ardamax defense_evasion discovery keylogger persistence stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

b355c411a253c37f48d84aac1040c20f_JaffaCakes118.exe

Resource

win10v2004-20241007-en

ardamax defense_evasion discovery keylogger persistence stealer

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  b355c411a253c37f48d84aac1040c20f_JaffaCakes118
- Size
  
  610KB
- MD5
  
  b355c411a253c37f48d84aac1040c20f
- SHA1
  
  0334fde6af352c24fe91432413e7aa14dd24abf3
- SHA256
  
  d9f9b12f1ecc9bbcc8d5eef4f12978163ff31968ee4391840ad99739cc6aebeb
- SHA512
  
  3202bd6b6c795a9a22c10db9d64b0222884d24964abf1495f3bb348c83e397dab41dc9d252fcbb7e4be3050e118cec6c6c5714283bd080c69ddcc80c13e63d61
- SSDEEP
  
  12288:vQHBLPUakcWb7ewCTpO6ekNyz0Ie8kgOLQZEYhQBVfI3795vx7O:vQHBLPJnWb70TyAF8VZ3QBS377x7O
Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

© 2018-2025

Terms | Privacy