ardamax | 440696d0079d2137a5c1236279c2b2298167051c27a59325fddf0f4f56f7b1b2 | Triage

Submit
Reports

Overview

overview

Static

static

7

JaffaCakes...df.exe

windows7-x64

JaffaCakes...df.exe

windows10-2004-x64

3

Sharing

General

Target

JaffaCakes118_ae06a4d1e5342c6ace7587b0de04d4df
Size

1.8MB
Sample

250206-wqmffaslhw
MD5

ae06a4d1e5342c6ace7587b0de04d4df
SHA1

fb25a9016f23a64285808a7ce6eeee6ac5a280da
SHA256

440696d0079d2137a5c1236279c2b2298167051c27a59325fddf0f4f56f7b1b2
SHA512

3758212e9ff2db500a521ecdeae86a15269ec557bd2a752477a9054db0ef79d2b46241f07217ae7e4313af2a11f1cac148cd779efc22964a9ce47620dbe46c04
SSDEEP

24576:5o1dv2igD/Ro9r/wgR+j++SMT3UAubmitrZVx4tKCXfC2b7t4uc+UxaqukBWQg:5NmJ/1TtsUAqz4VK2P2Q4aqHfg

Score

10^/10

ardamax discovery keylogger persistence stealer themida

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_ae06a4d1e5342c6ace7587b0de04d4df.exe

Resource

win7-20240903-en

ardamax discovery keylogger persistence stealer themida

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_ae06a4d1e5342c6ace7587b0de04d4df.exe

Resource

win10v2004-20250129-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_ae06a4d1e5342c6ace7587b0de04d4df
- Size
  
  1.8MB
- MD5
  
  ae06a4d1e5342c6ace7587b0de04d4df
- SHA1
  
  fb25a9016f23a64285808a7ce6eeee6ac5a280da
- SHA256
  
  440696d0079d2137a5c1236279c2b2298167051c27a59325fddf0f4f56f7b1b2
- SHA512
  
  3758212e9ff2db500a521ecdeae86a15269ec557bd2a752477a9054db0ef79d2b46241f07217ae7e4313af2a11f1cac148cd779efc22964a9ce47620dbe46c04
- SSDEEP
  
  24576:5o1dv2igD/Ro9r/wgR+j++SMT3UAubmitrZVx4tKCXfC2b7t4uc+UxaqukBWQg:5NmJ/1TtsUAqz4VK2P2Q4aqHfg
Score

10^/10

ardamax discovery keylogger persistence stealer themida
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealerthemida

behavioral2

© 2018-2025

Terms | Privacy