Overview

overview

10

Static

static

3

JaffaCakes...21.exe

windows7-x64

10

JaffaCakes...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5f97ff745681161b416dce314999bcb38617ef2ac5edc52f5c78814f84bbdd21

  • Size

    761.7MB

  • Sample

    241224-tp164a1nex

  • MD5

    546b8f444b7101f1dab3b2f488365242

  • SHA1

    3dbf439f71620542e18b8419d276d2bcf30be813

  • SHA256

    5f97ff745681161b416dce314999bcb38617ef2ac5edc52f5c78814f84bbdd21

  • SHA512

    84f46f8c050ab5b1956f46e5c9b24084ce4bfff4f7d470227eac000093b9e773301c088c7f8ef9c662d05dbaeafe0c6451fb30307ffd660aaf90892733e42bbb

  • SSDEEP

    12288:YXfBB/ocZiIY9RKsnlYqLbvv5z2BywLKQ7XID20I:mB/ocZiIFqLb38VLKC6ZI

Score
10/10
vidar408discoverystealer

Malware Config

Extracted

Family

vidar

Version

2.4

Botnet

408

C2

https://t.me/gurutist

https://steamcommunity.com/profiles/76561199476091435

http://95.216.164.28:80
Attributes
  • profile_id

    408

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36

Targets

    • Target

      JaffaCakes118_5f97ff745681161b416dce314999bcb38617ef2ac5edc52f5c78814f84bbdd21

    • Size

      761.7MB

    • MD5

      546b8f444b7101f1dab3b2f488365242

    • SHA1

      3dbf439f71620542e18b8419d276d2bcf30be813

    • SHA256

      5f97ff745681161b416dce314999bcb38617ef2ac5edc52f5c78814f84bbdd21

    • SHA512

      84f46f8c050ab5b1956f46e5c9b24084ce4bfff4f7d470227eac000093b9e773301c088c7f8ef9c662d05dbaeafe0c6451fb30307ffd660aaf90892733e42bbb

    • SSDEEP

      12288:YXfBB/ocZiIY9RKsnlYqLbvv5z2BywLKQ7XID20I:mB/ocZiIFqLb38VLKC6ZI

    Score
    10/10
    vidar408discoverystealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks