Categories: Malware

What is “MemScan:Application.Keylog.Ardamax.DMA”?

The MemScan:Application.Keylog.Ardamax.DMA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MemScan:Application.Keylog.Ardamax.DMA virus can do?

Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine MemScan:Application.Keylog.Ardamax.DMA?


File Info:
name: D30A5EDB4CBE5907CADE.mlwpath: /opt/CAPEv2/storage/binaries/210103f71113a915452b331611a096a727090567da8fdda154c44369b298b760crc32: 4748A2D9md5: d30a5edb4cbe5907cade16cedc63beffsha1: 8e1f464c25ba993ad24b0610f227f40a8beec1fasha256: 210103f71113a915452b331611a096a727090567da8fdda154c44369b298b760sha512: b808b5b46ed43c0ecf31a1201e37aa7c461ac08f24c3041164fa840f4769cf6addfbc7dc73ff148a304fda05c1228bb0370aa2f6b76221578f51bc4a81186248ssdeep: 24576:l64MVTbn99wNHPSGvZ5ExhOLF0fHwKp/vwiujsE:l64MTbnePZXEOLsVPostype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13A4533563B160336DCF78B794D6F8B389F3CB43312A2A01B15CFC69A2B566E440552EEsha3_384: 97a98aeb3e35e5dd77433cba83b439f867e5133b12af9f536ffaa3b605d421b0e4eeca40c339d816e77b4f6bc064ed28ep_bytes: e8b8220000e979feffff8bff558bec81timestamp: 2011-05-16 10:31:08
Version Info:
0: [No Data]

MemScan:Application.Keylog.Ardamax.DMA also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ardamax.lmIa
MicroWorld-eScan	MemScan:Application.Keylog.Ardamax.DMA
ClamAV	Win.Trojan.Agent-313898
FireEye	Generic.mg.d30a5edb4cbe5907
CAT-QuickHeal	Trojan.Ardamax.A
McAfee	Keylog-Ardamax.cg
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Trojan.Ardamax.Win32.5383
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Password-Stealer ( 0030898f1 )
Alibaba	RiskWare:Win32/ArchSMS.ebecc610
K7GW	Password-Stealer ( 0030898f1 )
CrowdStrike	win/malicious_confidence_70% (W)
BitDefenderTheta	Gen:NN.ZexaF.36744.lvW@aSG98bWT
VirIT	Trojan.Win32.SHeur3.BZWO
Symantec	Trojan.Malcol
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/KeyLogger.Ardamax.NAZ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:Monitor.Win32.Ardamax.ccs
BitDefender	MemScan:Application.Keylog.Ardamax.DMA
NANO-Antivirus	Trojan.Win32.Drop.xfpnf
Rising	Trojan.Win32.Akvexe.a (CLASSIC)
Sophos	Ardamax (PUA)
F-Secure	Trojan.TR/Spy.Gen
DrWeb	Trojan.MulDrop2.59534
VIPRE	MemScan:Application.Keylog.Ardamax.DMA
TrendMicro	TROJ_GEN.R002C0OBB24
Trapmine	malicious.high.ml.score
Emsisoft	MemScan:Application.Keylog.Ardamax.DMA (B)
Ikarus	IM-Worm.Win32.VB
Jiangmin	TrojanSpy.Ardamax.bng
Webroot	System.Monitor.Ardamax.Keylogge
Google	Detected
Avira	TR/Spy.Gen
Antiy-AVL	Trojan[Spy]/Win32.Ardamax
Xcitium	Malware@#edj9ot0k7d7u
Arcabit	Application.Keylog.Ardamax.DMA
ViRobot	Trojan.Win32.A.Ardamax.1223680
ZoneAlarm	not-a-virus:Monitor.Win32.Ardamax.ccs
GData	MemScan:Application.Keylog.Ardamax.DMA
Varist	W32/Ardamax.F_a.gen!Eldorado
AhnLab-V3	Trojan/Win32.Ardamax.R6533
DeepInstinct	MALICIOUS
VBA32	BScope.Backdoor.Xbot
ALYac	MemScan:Application.Keylog.Ardamax.DMA
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Generic Malware
TrendMicro-HouseCall	TROJ_GEN.R002C0OBB24
Tencent	Malware.Win32.Gencirc.10b33840
SentinelOne	Static AI – Malicious PE
MaxSecure	Hoax.ArchSMS.loaf
Fortinet	W32/Dropper.AAAE!tr
AVG	Win32:KeyloggerX-gen [Trj]
Avast	Win32:KeyloggerX-gen [Trj]