General
-
Target
7f594e90f0282baeb4e7ca60f078f4ee_JaffaCakes118
-
Size
295KB
-
Sample
241030-qlyd9asphw
-
MD5
7f594e90f0282baeb4e7ca60f078f4ee
-
SHA1
3094e140306c48e0942ba9ed55fe5b8f112876ae
-
SHA256
7d0f06b4c736f5740a16023e4edcd978f664caa64b32a9b1a4406d6a7b2382a8
-
SHA512
df5b1742dd1f1be5ce8d791c8bd31b46c656c7e3807c8f77bc9d40a34c57381172da0062286e2394b858a852d83ea5ab211b29fe8d5a3240884b52330628b7f4
-
SSDEEP
6144:ADov6LNM7a7JdbrBnuS5j3UOPHJa99bmtUWS2zx9uTamOrM49oW:XsNM7gdP5uyjrcUtQYTuTag49Z
Static task
static1
Behavioral task
behavioral1
Sample
7f594e90f0282baeb4e7ca60f078f4ee_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7f594e90f0282baeb4e7ca60f078f4ee_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
7f594e90f0282baeb4e7ca60f078f4ee_JaffaCakes118
-
Size
295KB
-
MD5
7f594e90f0282baeb4e7ca60f078f4ee
-
SHA1
3094e140306c48e0942ba9ed55fe5b8f112876ae
-
SHA256
7d0f06b4c736f5740a16023e4edcd978f664caa64b32a9b1a4406d6a7b2382a8
-
SHA512
df5b1742dd1f1be5ce8d791c8bd31b46c656c7e3807c8f77bc9d40a34c57381172da0062286e2394b858a852d83ea5ab211b29fe8d5a3240884b52330628b7f4
-
SSDEEP
6144:ADov6LNM7a7JdbrBnuS5j3UOPHJa99bmtUWS2zx9uTamOrM49oW:XsNM7gdP5uyjrcUtQYTuTag49Z
Score10/10-
Ardamax family
-
Ardamax main executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-