General

  • Target

    JaffaCakes118_eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a

  • Size

    778.6MB

  • Sample

    241222-ncymjswneq

  • MD5

    09c6875214def62b316d9d8f40f25742

  • SHA1

    24a317685809eec394720b33090e05a83b0976eb

  • SHA256

    eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a

  • SHA512

    7bcca9b57ad0590b766882aa1410899159b09b3ea6d8ff63ce87890db3dc533d4e2b09cad0bb58c46614ef1211b040e1c9bfd92cb44bb69a4d13ceca30269a62

  • SSDEEP

    25165824:1nnnnnnnnnnnnnnnnnnnnnnnnmnnnnnnnnnnnnnnnnnnnnnn:1nnnnnnnnnnnnnnnnnnnnnnnnmnnnnnn

Malware Config

Extracted

Family

vidar

Version

4.8

Botnet

27d0417c9847ebd9235b928714df3b9c

C2

https://t.me/vookihhfd

https://t.me/booliiksws

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531

Attributes
  • profile_id_v2

    27d0417c9847ebd9235b928714df3b9c

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Targets

    • Target

      JaffaCakes118_eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a

    • Size

      778.6MB

    • MD5

      09c6875214def62b316d9d8f40f25742

    • SHA1

      24a317685809eec394720b33090e05a83b0976eb

    • SHA256

      eb44bfea15585a4d23b8bcb84c9ba166bf2c0d301dc1d2a1edc597892381738a

    • SHA512

      7bcca9b57ad0590b766882aa1410899159b09b3ea6d8ff63ce87890db3dc533d4e2b09cad0bb58c46614ef1211b040e1c9bfd92cb44bb69a4d13ceca30269a62

    • SSDEEP

      25165824:1nnnnnnnnnnnnnnnnnnnnnnnnmnnnnnnnnnnnnnnnnnnnnnn:1nnnnnnnnnnnnnnnnnnnnnnnnmnnnnnn

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Enterprise v15

Tasks