General

  • Target

    ee06144da6d6e04239dd6f37322611e0_JaffaCakes118

  • Size

    694KB

  • Sample

    240411-wmfhqagg75

  • MD5

    ee06144da6d6e04239dd6f37322611e0

  • SHA1

    d5c5f198b8c424e0f7d6c0b24b7aeaab98a2a0ac

  • SHA256

    8222e5fb27ab87f640ccf09b30feeecc20ed9fedc91f953c9dae61fdf51ec16b

  • SHA512

    4dca0a459bf181469faee169d75fb757a4da5c5af6cffd73f9260c8fb9f0f7f0e5936d31d21587e2ab5c953ceba890e4b0e2aff4f9fd7bb225e05fbf12a2ec8e

  • SSDEEP

    12288:tDR6zb2IAbh0dthDOUuPWLaZlAAMkthS+dhaPTOOybiam7MJzi9S7IGOu:Gv2bbhiDOUXLanokpbaPT0biaMxmOu

Score
10/10

Malware Config

Extracted

Family

vidar

Version

40

Botnet

517

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    517

Targets

    • Target

      ee06144da6d6e04239dd6f37322611e0_JaffaCakes118

    • Size

      694KB

    • MD5

      ee06144da6d6e04239dd6f37322611e0

    • SHA1

      d5c5f198b8c424e0f7d6c0b24b7aeaab98a2a0ac

    • SHA256

      8222e5fb27ab87f640ccf09b30feeecc20ed9fedc91f953c9dae61fdf51ec16b

    • SHA512

      4dca0a459bf181469faee169d75fb757a4da5c5af6cffd73f9260c8fb9f0f7f0e5936d31d21587e2ab5c953ceba890e4b0e2aff4f9fd7bb225e05fbf12a2ec8e

    • SSDEEP

      12288:tDR6zb2IAbh0dthDOUuPWLaZlAAMkthS+dhaPTOOybiam7MJzi9S7IGOu:Gv2bbhiDOUXLanokpbaPT0biaMxmOu

    Score
    10/10
    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar Stealer

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Tasks