Ardamax Keylogger Description

Ardamax Keylogger is a commercial keylogger that tracks the user’s online activity and records every keystroke typed. Ardamax Keylogger has the uncanny ability of being able to conceal itself while running. Logs are sent to a configurable email address or uploaded to a predefined FTP server. Ardamax Keylogger must be manually installed. Ardamax Keylogger runs on every Windows startup. Ardamax may put the user’s most sensitive financial and private personal data at risk.

Type: Keyloggers

Automatic Detection of Ardamax Keylogger

Ardamax Keylogger Technical Report

As new Ardamax Keylogger details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Ardamax Keylogger files with its MD5s were created in the system:

Ardamax Keylogger has typically the following processes in memory:

• nsk.exe
• %SYSTEMROOT%\system32\28463\NQND.exe
• akv.exe
• kh.dll
• akl.exe
• il.dll

Ardamax Keylogger creates the following registry entries:

• HKEY_CURRENT_USERSoftwareArdamaxKeyloggerLite
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunNSK
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallArdamaxKeylogger
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunArdamaxKeylogger
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsAppPathsakl.exe

Important Article Disclaimer