Extracted

• • Target

    e34e031f90002ad25ca1b315e0a0e1ca_JaffaCakes118

  • Size

    2.0MB

  • MD5

    e34e031f90002ad25ca1b315e0a0e1ca

  • SHA1

    ed594f951eed29c1354e6d9e65f82cc27b39b060

  • SHA256

    60c410c65d8b07444b092f5fb71b2b3f071a0cb92230fad7211551309611d899

  • SHA512

    4c08ffaa9301f963c54cb8aa17bce30d833121b056c06903606ca1fe0d9e3a112b20ae72dde5e623acdf3bde15e75830f43f86594eed46e3ddc411e2bee9149f

  • SSDEEP

    24576:w9Uoe69/dlRsxV7/igVTHl+mwmbz0Zl+p/+c6qacm5PO/k:mUoe61SxwgVj4mboZiU

  Score

  10^/10

  vidar615credential_accessdiscoverypersistenceprivilege_escalationrezer0spywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Vidar Stealer

    stealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2