Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/12/2024, 16:34
General
-
Target
c4a68f60a470e7a8a91d2a23d50ffb492ec5119a3311d5c3bae7f9faca5bdc0c.exe
-
Size
726.8MB
-
MD5
90b6157f3d232a14136bd4b1cf6d226e
-
SHA1
204d63255a5addfad3afbc0a9d82a80cd05d716a
-
SHA256
c4a68f60a470e7a8a91d2a23d50ffb492ec5119a3311d5c3bae7f9faca5bdc0c
-
SHA512
642e5acf719f64b59b795edcf34ec9aecce9de12908bfdd8c6b356d1d793db203a19a02b51f7d9183d36a7fecffa0b01d164f2610d967be24ea85ca1e795133e
-
SSDEEP
196608:jYmgaJptScC8HFvdacoNIEJrwHCf3cHx5:jgaTvda3WRQ3cL
Score
10/10
Malware Config
Extracted
Family
vidar
Version
2.1
Botnet
670
C2
https://t.me/jetbim
https://steamcommunity.com/profiles/76561199471266194
http://65.21.58.6:80
Attributes
-
profile_id
670
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a68f60a470e7a8a91d2a23d50ffb492ec5119a3311d5c3bae7f9faca5bdc0c.exe"C:\Users\Admin\AppData\Local\Temp\c4a68f60a470e7a8a91d2a23d50ffb492ec5119a3311d5c3bae7f9faca5bdc0c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
-
Filesize
10.7MB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
3.5MB
-
Filesize
10.7MB