{
  "family": "ardamax",
  "sample_count": 114,
  "category": "infostealer",
  "description": "PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring software that became overwhelmingly abused by cybercriminals as a covert corporate espionage and credential theft weapon. Operating in total stealth mode, Ardamax hooks the Windows keyboard message queue (via SetWindowsHookEx API) to log every keystroke, capture window titles, and intercept clipboard contents in real time. It periodically takes desktop screenshots, records microphone audio, and photographs users via connected webcams, packing the collected surveillance data into encrypted, password-protected archive files. Ardamax exfiltrates stolen logs automatically at scheduled intervals via hidden SMTP email messages, direct FTP server uploads, or network share delivery. Cybercriminals weaponize Ardamax by wrapping the installer inside custom crypters, distributing it via targeted spear-phishing emails containing spoofed business transaction inquiries to compromise corporate executive workstations and steal banking and email credentials.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ardamax",
    "Ardamax Keylogger",
    "PWS:Win32/Ardamax",
    "Trojan.Ardamax",
    "Spyware.Ardamax"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ardamax Keylogger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ardamax Keylogger is a surveillance utility widely abused by cybercriminals to silently capture keystrokes, screenshots, audio, and web browser credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ardamax capture keystrokes in Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ardamax registers Windows hooks using the SetWindowsHookEx API to intercept keyboard input across all active applications."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ardamax exfiltrate stolen data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ardamax packs logs into encrypted archive files and transmits them to attackers via hidden SMTP emails, FTP uploads, or local network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How is Ardamax deployed against corporate targets?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers wrap Ardamax in crypters and distribute it through spear-phishing emails disguised as purchase orders, invoices, or business quotes."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities are used to drop Ardamax?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ardamax campaigns frequently exploit Microsoft Office vulnerabilities including CVE-2012-0158 and CVE-2017-0199 in weaponized attachments."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1115",
    "T1071.003",
    "T1059.003"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "collection"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "collection"
    },
    {
      "id": "T1071.003",
      "name": "Mail Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2004,
  "lineage": {
    "derived_from": [],
    "variants": [
      "ardamax v1.x (2004)",
      "ardamax v3.x",
      "ardamax v5.x commercial build"
    ]
  },
  "attribution": [
    {
      "actor": "Ardamax Software (Commercial Developer)",
      "confidence": "high"
    },
    {
      "actor": "Global Cybercrime Syndicates",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2012-0158",
    "CVE-2017-0199"
  ],
  "c2_profile": {
    "protocols": [
      "SMTP",
      "FTP",
      "HTTP"
    ],
    "ports": [
      25,
      21,
      80
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "1d2c6762391ea2837493a109a927ec0bc1d34c2ab79d67e5ff825c88b64e5257",
      "841893d5f308e7ef9e4345eb6eeecb321a59051d95dc48e77a9497e68db30058"
    ],
    "delivery": [
      "spearphishing_attachments",
      "trojanized_installers"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Windows Service Creation"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia: Ardamax Keylogger Profile",
      "url": "https://www.trendmicro.com/"
    },
    {
      "name": "Symantec Security Response: Trojan.Ardamax Analysis",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2012-0158",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0158"
    }
  ],
  "containment_steps": [
    "Terminate unverified background monitoring processes hooking keyboard messages.",
    "Block outbound SMTP (port 25) and FTP (port 21) connections originating from employee workstations.",
    "Reset credentials for corporate email, VPN, and banking portals accessed from compromised hosts.",
    "Apply security patches for Microsoft Office vulnerabilities CVE-2012-0158 and CVE-2017-0199."
  ],
  "what_to_avoid": [
    "Do not allow unrestricted outbound SMTP connections from user endpoint subnets.",
    "Avoid opening unsolicited business invoice attachments received from unknown senders.",
    "Never store master corporate credentials in plain text desktop notes."
  ],
  "target_industries": [
    "corporate_accounting",
    "manufacturing",
    "small_business",
    "consumers"
  ],
  "motivation": "Corporate Espionage, Credential Harvesting & Surreptitious Surveillance",
  "threat_actors": [
    "Global Cybercrime Syndicates"
  ],
  "target_geographies": [
    "US",
    "GB",
    "DE",
    "FR",
    "IN",
    "AU"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}