Extracted

• • Target

    JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26

  • Size

    336.4MB

  • MD5

    876f5de542386abdc4699b77687e279e

  • SHA1

    24c0161a3968a97443be2cd1d1d96181285947bd

  • SHA256

    324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26

  • SHA512

    d1f12d0611093008d707d04c58dbae510dc84dfeb738a8052c174e2d2b5225226b398417ae918bb64792e41cec69eec4cc7ad66d7c15de0e6c664d3baa897f5b

  • SSDEEP

    98304:3QHpw7wLHY5E5ThVOTYheiqTBODGm/RygXAWVWCwi+1j7:AHpw7v5EPuBxeIhWVJw/1P

  Score

  10^/10

  vidar670discoveryevasionstealertrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Vidar Stealer

    stealer

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2