Analysis
-
max time kernel
88s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 20:22
General
-
Target
JaffaCakes118_5d7c05c6cd191b8b38dabc343a1ec22b6631672929f8374fa44807a5f9847f19.exe
-
Size
675.4MB
-
MD5
cbbf92ce3daf529349bad0a1baf27337
-
SHA1
a78e57b170b03b121e6799c020a6d388f9622009
-
SHA256
5d7c05c6cd191b8b38dabc343a1ec22b6631672929f8374fa44807a5f9847f19
-
SHA512
c288b697808211797fd82a682ae1cdbe0e4cd1940b8c1bb6846b175e78771af3f5f1f52c7fc13d5f3ab253dd1bb5c81d9d42f1549a27381c7e70db703d374c88
-
SSDEEP
12582912:9YQyQyQyQyQyQyQyQyQyQyQyQyQyQyQ1QyQyQyQyQyQyQyQyQyQyQyQyQyQyQ1Qe:9Ynnnnnnnnnnnnnn0nnnnnnnnnnnnnnc
Malware Config
Extracted
vidar
4.5
f5142d59cfb1f363a412294f1ea824ba
https://steamcommunity.com/profiles/76561199520592470
https://t.me/motafan
-
profile_id_v2
f5142d59cfb1f363a412294f1ea824ba
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/111.0
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d7c05c6cd191b8b38dabc343a1ec22b6631672929f8374fa44807a5f9847f19.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d7c05c6cd191b8b38dabc343a1ec22b6631672929f8374fa44807a5f9847f19.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
-
Filesize
4KB
-
Filesize
11.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
11.3MB
-
Filesize
4KB
-
Filesize
4.5MB
-
Filesize
11.3MB