Analysis
-
max time kernel
127s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 14:40
General
-
Target
JaffaCakes118_7c31b96c380c4862d280bf119b7afaeb951cb0190a05a58b25e46ad6bf01c3b4.exe
-
Size
787.4MB
-
MD5
513273b8c3d627f28bead53b61b62d22
-
SHA1
4030328d963383612cd99ddad191e42d56c44d97
-
SHA256
7c31b96c380c4862d280bf119b7afaeb951cb0190a05a58b25e46ad6bf01c3b4
-
SHA512
1537c176727547ef4a17c294600c834deedb7d583ee67ebf4f056ea83080dcb09c63cfbd1977e926f766fe980230bb76ce29a29dad9834a9e21d1a46d2ae5a63
-
SSDEEP
25165824:BnnnnnnnnnnnnnnnnnnnnnpnnnnnnnnnnnnnnnnnnnnnpnnnnZ:Bnnnnnnnnnnnnnnnnnnnnnpnnnnnnnn7
Malware Config
Extracted
vidar
4.9
c16a465ccc6a374a63c60139396c2756
https://t.me/vookihhfd
https://t.me/booliiksws
https://t.me/dastantim
https://steamcommunity.com/profiles/76561199529242058
-
profile_id_v2
c16a465ccc6a374a63c60139396c2756
-
user_agent
Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c31b96c380c4862d280bf119b7afaeb951cb0190a05a58b25e46ad6bf01c3b4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c31b96c380c4862d280bf119b7afaeb951cb0190a05a58b25e46ad6bf01c3b4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.7MB
-
Filesize
2.8MB
-
Filesize
13.7MB