Overview

overview

10

Static

static

7

JaffaCakes...9a.exe

windows7-x64

10

JaffaCakes...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_72b00a7e7cd31bd9c102d7473208115cfd2586c2a7c081957250ef1762b6059a

  • Size

    677.6MB

  • Sample

    241223-wyarlsxjgx

  • MD5

    1121503015a0161f94ceaba6461390d0

  • SHA1

    1e9ac9da1bef57aa879e9f13cfd3951177c4b96f

  • SHA256

    72b00a7e7cd31bd9c102d7473208115cfd2586c2a7c081957250ef1762b6059a

  • SHA512

    370218c27c01b8c9f4a3bc5da29ad3b6ff4758c24e3a97e2389214f4963e2299c3cb0aacf711b8a33f2f78919fceac862da6cfbb28107541cfc1666237327482

  • SSDEEP

    12582912:qQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQKQyQyQyQyQyQyn:qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn

Score
10/10
vidare80365af73075d595692b2d62040c2c8discoverystealervmprotect

Malware Config

Extracted

Family

vidar

Version

4.8

Botnet

e80365af73075d595692b2d62040c2c8

C2

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531
Attributes
  • profile_id_v2

    e80365af73075d595692b2d62040c2c8

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Targets

    • Target

      JaffaCakes118_72b00a7e7cd31bd9c102d7473208115cfd2586c2a7c081957250ef1762b6059a

    • Size

      677.6MB

    • MD5

      1121503015a0161f94ceaba6461390d0

    • SHA1

      1e9ac9da1bef57aa879e9f13cfd3951177c4b96f

    • SHA256

      72b00a7e7cd31bd9c102d7473208115cfd2586c2a7c081957250ef1762b6059a

    • SHA512

      370218c27c01b8c9f4a3bc5da29ad3b6ff4758c24e3a97e2389214f4963e2299c3cb0aacf711b8a33f2f78919fceac862da6cfbb28107541cfc1666237327482

    • SSDEEP

      12582912:qQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQKQyQyQyQyQyQyn:qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn

    Score
    10/10
    vidare80365af73075d595692b2d62040c2c8discoverystealervmprotect

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks