Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 13:07
General
-
Target
JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe
-
Size
336.4MB
-
MD5
876f5de542386abdc4699b77687e279e
-
SHA1
24c0161a3968a97443be2cd1d1d96181285947bd
-
SHA256
324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26
-
SHA512
d1f12d0611093008d707d04c58dbae510dc84dfeb738a8052c174e2d2b5225226b398417ae918bb64792e41cec69eec4cc7ad66d7c15de0e6c664d3baa897f5b
-
SSDEEP
98304:3QHpw7wLHY5E5ThVOTYheiqTBODGm/RygXAWVWCwi+1j7:AHpw7v5EPuBxeIhWVJw/1P
Malware Config
Extracted
vidar
51.9
670
https://t.me/btc20220425
https://ieji.de/@ronxik213
-
profile_id
670
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Vidar Stealer 19 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_324c6159854181351a28a38c3f38a00007f2f150ef0d1c77fcc30424a8de6b26.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.2MB
-
Filesize
280KB
-
Filesize
220KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
2.1MB
-
Filesize
7.2MB
-
Filesize
2.5MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
144KB
-
Filesize
2.1MB
-
Filesize
7.2MB
-
Filesize
1.1MB
-
Filesize
1000KB
-
Filesize
764KB
-
Filesize
7.2MB
-
Filesize
1.4MB
-
Filesize
7.2MB
-
Filesize
280KB
-
Filesize
220KB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
764KB
-
Filesize
2.5MB
-
Filesize
7.2MB
-
Filesize
1000KB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
1.1MB
-
Filesize
1000KB
-
Filesize
764KB