Extracted

• • Target

    e7c3ab0f7b5c809977a4865e74899ccb_JaffaCakes118

  • Size

    860KB

  • MD5

    e7c3ab0f7b5c809977a4865e74899ccb

  • SHA1

    ab2dbb6e074df592ca92326efa14a0758cba5e79

  • SHA256

    27b580b1156add1d4b8c3db4f2912663c714583db0ab5bab9549bc47d0b3e96c

  • SHA512

    b2376d1334e66b5362f048fb625d07dd3d6d4dcdae04aaf03ac31e1c5969192375d52b055a4096b7829f2eb192885e99cbd8636a44a2e2bf03026b77567cafc2

  • SSDEEP

    24576:+NWSXSR45Lx/WJO3Z91CQq+47kElkBvJeX:hJ8RCQqZ

  Score

  10^/10

  vidar45credential_accessdiscoveryspywarestealer

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Vidar Stealer

    stealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2