ardamax | cff7d83527fc620cf1424d28b5670719a8fe2687cade5e14e9a05434407f0840 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...d5.exe

windows7-x64

JaffaCakes...d5.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_0dc17f724007acda1ca2f36d1be745d5
Size

378KB
Sample

250122-pz6r4sxqbl
MD5

0dc17f724007acda1ca2f36d1be745d5
SHA1

312b8319e2c2e1040447136865d26d68d9c3d8b2
SHA256

cff7d83527fc620cf1424d28b5670719a8fe2687cade5e14e9a05434407f0840
SHA512

896c18db0807ca4daf70d7299dbcdbf14b184295593c921d879fa5f281115f09fb16fe16a380348b86587fc7545e8b4b1a67e15063a9b263c463bfa6301326bf
SSDEEP

6144:LmpyGUJlZvCKwaXreEOC3kBp4eMrS8ElA8Z8Bub81juaCvNJQa:LpnCKwabeh2X3rSRl3Kye16Jh

Score

10^/10

ardamax bootkit discovery keylogger persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_0dc17f724007acda1ca2f36d1be745d5.exe

Resource

win7-20240708-en

ardamax bootkit discovery keylogger persistence stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_0dc17f724007acda1ca2f36d1be745d5.exe

Resource

win10v2004-20241007-en

ardamax discovery keylogger stealer

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_0dc17f724007acda1ca2f36d1be745d5
- Size
  
  378KB
- MD5
  
  0dc17f724007acda1ca2f36d1be745d5
- SHA1
  
  312b8319e2c2e1040447136865d26d68d9c3d8b2
- SHA256
  
  cff7d83527fc620cf1424d28b5670719a8fe2687cade5e14e9a05434407f0840
- SHA512
  
  896c18db0807ca4daf70d7299dbcdbf14b184295593c921d879fa5f281115f09fb16fe16a380348b86587fc7545e8b4b1a67e15063a9b263c463bfa6301326bf
- SSDEEP
  
  6144:LmpyGUJlZvCKwaXreEOC3kBp4eMrS8ElA8Z8Bub81juaCvNJQa:LpnCKwabeh2X3rSRl3Kye16Jh
Score

10^/10

ardamax bootkit discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxbootkitdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy