Keylogger.Ardamax Removal Report

Table of Contents

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
Fortinet	W32/Gbot.YRA!tr.bdr
AntiVir	SPR/Tool.Ardamax.556
Kaspersky	Backdoor.Win32.Gbot.yra
McAfee	Artemis!647F311B4718
AVG	Ardamax.BUD
BitDefender	MemScan:Trojan.Generic.8306227
Avast	Win32:Ardamax-PU [PUP]
McAfee	Artemis!3DEBCBACE7A0
AVG	Ardamax.BWQ
DrWeb	Trojan.KeyLogger.18881
McAfee	Artemis!D7BB86DA5866
DrWeb	Trojan.KeyLogger.19070
DrWeb	Trojan.KeyLogger.16596
Avast	Win32:Ardamax-QG [PUP]
AntiVir	SPR/Tool.Monitor.Gen

File System Details

Keylogger.Ardamax may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	CSJ.exe	29a6ac921bfd693769a7f7e255dc2e77	37
Name: CSJ.exe MD5: 29a6ac921bfd693769a7f7e255dc2e77 Size: 1.8 MB (1801728 bytes) Detections: 37 Type: Executable File Path: %PROGRAMFILES%\CSJ Group: Malware file Last Updated: July 26, 2012
2.	setup_akl64 (password=ardamax).exe	e33b737b368c02ef9b7c908c9472dfef	14
Name: setup_akl64 (password=ardamax).exe MD5: e33b737b368c02ef9b7c908c9472dfef Size: 2.06 MB (2065604 bytes) Detections: 14 Type: Executable File Path: C:\Users\<username>\AppData\Roaming\setup_akl64 (password=ardamax).exe Group: Malware file Last Updated: April 30, 2022
3.	DFC.exe	b37aad7a36fbbb2d2054e082d590a76c	11
Name: DFC.exe MD5: b37aad7a36fbbb2d2054e082d590a76c Size: 1.81 MB (1819648 bytes) Detections: 11 Type: Executable File Path: %PROGRAMFILES(x86)%\Ardamax Group: Malware file Last Updated: April 3, 2020
4.	AKV.exe	b8fa30233794772b8b76b4b1d91c7321	8
Name: AKV.exe MD5: b8fa30233794772b8b76b4b1d91c7321 Size: 404.48 KB (404480 bytes) Detections: 8 Type: Executable File Path: C:\Windows\SysWOW64\28463\AKV.exe Group: Malware file Last Updated: December 1, 2022
5.	LYA.exe	3cd29c0df98a7aeb69a9692843ca3edb	7
Name: LYA.exe MD5: 3cd29c0df98a7aeb69a9692843ca3edb Size: 1.74 MB (1747968 bytes) Detections: 7 Type: Executable File Path: C:\WINDOWS\SysWOW64\FXVDEA\LYA.exe Group: Malware file Last Updated: March 3, 2023
6.	AKV.exe	51507d91d43683b9c4b8fafeb4d888f8	5
Name: AKV.exe MD5: 51507d91d43683b9c4b8fafeb4d888f8 Size: 467.45 KB (467456 bytes) Detections: 5 Type: Executable File Path: C:\WINDOWS\SysWOW64\FXVDEA\AKV.exe Group: Malware file Last Updated: March 3, 2023
7.	CSJ.exe	16a7080bdbdd3c66f6edef08c5bea843	5
Name: CSJ.exe MD5: 16a7080bdbdd3c66f6edef08c5bea843 Size: 1.8 MB (1801728 bytes) Detections: 5 Type: Executable File Path: %PROGRAMFILES(x86)%\CSJ Group: Malware file Last Updated: October 9, 2012
8.	ETK.exe	56dce36cac37d632bf722e9804e4965e	4
Name: ETK.exe MD5: 56dce36cac37d632bf722e9804e4965e Size: 1.83 MB (1838080 bytes) Detections: 4 Type: Executable File Path: %PROGRAMFILES(x86)%\ETK Group: Malware file Last Updated: October 17, 2012
9.	BCR.exe	b910f5d24e399a13f6aae20535ac05b4	4
Name: BCR.exe MD5: b910f5d24e399a13f6aae20535ac05b4 Size: 1.82 MB (1829888 bytes) Detections: 4 Type: Executable File Path: C:\Windows\SysWOW64\WLGGBN\BCR.exe Group: Malware file Last Updated: August 14, 2022
10.	setup_akl64 (password=ardamax).exe	e3d267c02ec24bd475e394551cca6ad0	4
Name: setup_akl64 (password=ardamax).exe MD5: e3d267c02ec24bd475e394551cca6ad0 Size: 2.13 MB (2139332 bytes) Detections: 4 Type: Executable File Path: C:\Users\<username>\AppData\Roaming\setup_akl64 (password=ardamax).exe Group: Malware file Last Updated: October 15, 2021
11.	MAI.exe	e40fa583acd317b71575596bd8bc10b8	3
Name: MAI.exe MD5: e40fa583acd317b71575596bd8bc10b8 Size: 1.83 MB (1830400 bytes) Detections: 3 Type: Executable File Path: %PROGRAMFILES(x86)%\MAI Group: Malware file Last Updated: August 27, 2012
12.	MSQ.exe	f22340c8c0caad1136de9bec84c82281	3
Name: MSQ.exe MD5: f22340c8c0caad1136de9bec84c82281 Size: 1.82 MB (1829888 bytes) Detections: 3 Type: Executable File Path: %USERPROFILE%\Desktop\ketlog\MSQ Group: Malware file Last Updated: August 11, 2020
13.	ELU.exe	785197d7f66a482b64c5ae297016d24e	3
Name: ELU.exe MD5: 785197d7f66a482b64c5ae297016d24e Size: 1.83 MB (1830400 bytes) Detections: 3 Type: Executable File Path: %WINDIR%\system32\NWXJWM Group: Malware file Last Updated: October 30, 2012
14.	POL.exe	8459b0ba642d016c60571a3ad31e6ec8	3
Name: POL.exe MD5: 8459b0ba642d016c60571a3ad31e6ec8 Size: 616.96 KB (616960 bytes) Detections: 3 Type: Executable File Path: %PROGRAMFILES(x86)%\POL Group: Malware file Last Updated: November 21, 2019
15.	setup_akl (password=ardamax).exe	725f36560115d2a096df3e499d6ba449	3
Name: setup_akl (password=ardamax).exe MD5: 725f36560115d2a096df3e499d6ba449 Size: 1.82 MB (1825918 bytes) Detections: 3 Type: Executable File Path: f:\pendrive blanca Group: Malware file Last Updated: October 15, 2021
16.	TND.exe	a6c12264242dba831b32523a07688d4a	2
Name: TND.exe MD5: a6c12264242dba831b32523a07688d4a Size: 470.52 KB (470528 bytes) Detections: 2 Type: Executable File Path: %WINDIR%\system32\Sys Group: Malware file Last Updated: March 29, 2013
17.	QHI.exe	d5918580ed2951ab6b1a5a94719757ff	2
Name: QHI.exe MD5: d5918580ed2951ab6b1a5a94719757ff Size: 1.83 MB (1830400 bytes) Detections: 2 Type: Executable File Path: %WINDIR%\SysWOW64\YAINGK Group: Malware file Last Updated: March 29, 2013
18.	FYB.exe	14f067c0291ce6a4a4c4735ba7f4712d	2
Name: FYB.exe MD5: 14f067c0291ce6a4a4c4735ba7f4712d Size: 1.79 MB (1794560 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE%\FYB Group: Malware file Last Updated: March 4, 2013
19.	WDI.exe	ed53cef3e425639f180392ccf031f9ce	2
Name: WDI.exe MD5: ed53cef3e425639f180392ccf031f9ce Size: 1.83 MB (1830400 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE%\WDI Group: Malware file Last Updated: October 9, 2012
20.	NGK.exe	0aaffc12ef1b416b9276bdc3fdec9dff	2
Name: NGK.exe MD5: 0aaffc12ef1b416b9276bdc3fdec9dff Size: 1.54 MB (1544192 bytes) Detections: 2 Type: Executable File Path: %WINDIR%\SysWOW64\LJXVCN Group: Malware file Last Updated: February 11, 2013
21.	HWF.exe	647f311b471810298c1d0b3b43966d8c	2
Name: HWF.exe MD5: 647f311b471810298c1d0b3b43966d8c Size: 1.82 MB (1829888 bytes) Detections: 2 Type: Executable File Path: %WINDIR%\SysWOW64\ACDYGC Group: Malware file Last Updated: May 13, 2013
22.	UIB.exe	47d45da7bc718cef809ecec470987248	1
Name: UIB.exe MD5: 47d45da7bc718cef809ecec470987248 Size: 292.86 KB (292864 bytes) Detections: 1 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: February 7, 2011
23.	YHF.exe	ff5d248fc602b8d6fb11a7aa8cf27391	1
Name: YHF.exe MD5: ff5d248fc602b8d6fb11a7aa8cf27391 Size: 280.57 KB (280576 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES%\YHF Group: Malware file Last Updated: November 1, 2011
24.	YEY.exe	53522c8c3b01191caae1e1e2692c42de	1
Name: YEY.exe MD5: 53522c8c3b01191caae1e1e2692c42de Size: 1.79 MB (1793024 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES%\YEY Group: Malware file Last Updated: January 8, 2013
25.	YHH.exe	7f9e58f1df8721ed17066d08a769c73a	1
Name: YHH.exe MD5: 7f9e58f1df8721ed17066d08a769c73a Size: 1.82 MB (1829888 bytes) Detections: 1 Type: Executable File Path: %WINDIR%\SysWOW64\OWSNDV Group: Malware file Last Updated: November 2, 2012
26.	JTF.exe	ce6e2998fc31ef25e3771cd7be4f4e75	1
Name: JTF.exe MD5: ce6e2998fc31ef25e3771cd7be4f4e75 Size: 1.53 MB (1531904 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES%\JTF Group: Malware file Last Updated: March 12, 2013

More files

Registry Details

Keylogger.Ardamax may create the following registry entry or registry entries:

File name without path

setup (password=ardamax).exe

Regexp file mask

%APPDATA%\support\svchost.exe

HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}

Ardamax Keylogger

Directories

Keylogger.Ardamax may create the following directory or directories:

%ALLUSERSPROFILE%\auk

%ALLUSERSPROFILE%\cve

%WINDIR%\Syswow64\sys32

%WINDIR%\system32\sys32

Ranking:	7,556
Threat Level:	80 % (High)
Infected Computers:	10,238

First Seen:	July 24, 2009
Last Seen:	March 23, 2024
OS(es) Affected:	Windows

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Keylogger.Ardamax

Threat Scorecard

EnigmaSoft Threat Scorecard

Aliases

File System Details

Registry Details

Directories

Submit Comment

Related Posts

Keylogger.Ardamax.F

Keylogger.Ardamax.AC

Keylogger.Ardamax.C

Trending

Videovor.com

Softcnapp

Snadsfit.com

Most Viewed

Discord Shows Black Screen when Sharing Screen

How To Fix 'Printer Driver is Unavailable' Error

What is Msedge.exe?