Analysis
-
max time kernel
129s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 23:01
General
-
Target
JaffaCakes118_d8164ad502d9fa0ec145a3edec89b088bf1b1da9ae132ace0904882bbd71f25e.exe
-
Size
781.2MB
-
MD5
f753fbc1ef631bd73b3bbec0a9e107a6
-
SHA1
687c4655c40afd49761cfa8ee54594a5580d62a1
-
SHA256
d8164ad502d9fa0ec145a3edec89b088bf1b1da9ae132ace0904882bbd71f25e
-
SHA512
ac7937407fa6d78f0d4c891dde98097a4b54dc9a7fb365ec184932caa3f2f04863fd53543c3d78058978c1aa8ba1c9afe3fd08ba8b5634273d018dd3d95d5d31
-
SSDEEP
25165824:Knnnnnnnnnnnnnnnntnnnnnnnnnnnnnnnntnnnnnnnnnnnnj:Knnnnnnnnnnnnnnnntnnnnnnnnnnnnn9
Malware Config
Extracted
vidar
4.7
b3512cd5116d9bb95f02823bc8e0bf46
https://t.me/vookihhfd
https://t.me/booliiksws
https://t.me/eagl3z
https://steamcommunity.com/profiles/76561199159550234
-
profile_id_v2
b3512cd5116d9bb95f02823bc8e0bf46
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1788.0 uacq
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8164ad502d9fa0ec145a3edec89b088bf1b1da9ae132ace0904882bbd71f25e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8164ad502d9fa0ec145a3edec89b088bf1b1da9ae132ace0904882bbd71f25e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.8MB
-
Filesize
3.8MB
-
Filesize
14.8MB