vidar | 0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c

Analysis

max time kernel
146s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c.exe
Size

775.9MB
MD5

f691773db94d27eeeead8f6b9ffb70e9
SHA1

c09d0b614b1ea7373d14ac79370db2a4c05a53b7
SHA256

0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c
SHA512

6e6bc3e96e5cb8d2af0a7fa81ff48357c607e5b4e095e1f15a839d0cb6c010c3fe9da7587a69703070b174b4c59d382cb7ef67d06a53b1e975f825819bcf1276
SSDEEP

25165824:/nnnnnnnnnnnnnnnnnnnnnWnnnnnnnnnnnnnnnnnnnnnWnnnm:/nnnnnnnnnnnnnnnnnnnnnWnnnnnnnnn

Score

10^/10

vidar 9c4d13eb7131cf1bfda3cac74582a7d5 discovery stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

9c4d13eb7131cf1bfda3cac74582a7d5

https://steamcommunity.com/profiles/76561199532186526

https://t.me/vookihhfd

https://t.me/booliiksws

https://t.me/versozaline

Attributes

profile_id_v2
9c4d13eb7131cf1bfda3cac74582a7d5
user_agent
Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	JaffaCakes118_0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c.exe
1096	JaffaCakes118_0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b80c6f49f9dc1454db0d7b4e2df19fe13f6e586613b4cec0247e2db9a7e639c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-1-0x0000000000D84000-0x00000000010E1000-memory.dmp

Filesize
3.4MB

Download
memory/1096-0-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1096-2-0x0000000000A70000-0x0000000001A53000-memory.dmp

Filesize
15.9MB

Download
memory/1096-17-0x0000000000D84000-0x00000000010E1000-memory.dmp

Filesize
3.4MB

Download
memory/1096-18-0x0000000000A70000-0x0000000001A53000-memory.dmp

Filesize
15.9MB

Download