Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 21:19
General
-
Target
JaffaCakes118_8335ea0b1510f82592f710ce7e79b69a6ea8e9886f303bbe07c25b872c7a9484.exe
-
Size
727.3MB
-
MD5
9f6114f9172e1ee3105be1622bf3a9a6
-
SHA1
419425c3be4b890103919694d18f3b7bcb0f979a
-
SHA256
8335ea0b1510f82592f710ce7e79b69a6ea8e9886f303bbe07c25b872c7a9484
-
SHA512
4078cd60de96e667f1dd646c24637841e2707a7780c2336f0113c60bef92847e3652f7b654024e17986f9a7cda0f94671b2b72b786e4d2fc45d8866b7c6ee045
-
SSDEEP
196608:gdkyf7bsg8tniJ+uCpoAMba/dGEj4oYomLqXWrYrMOTEU:ekyf/18tniSqhOdXjnhmLoWrI
Malware Config
Extracted
vidar
2.1
670
https://t.me/jetbim
https://steamcommunity.com/profiles/76561199471266194
http://65.21.58.6:80
-
profile_id
670
Signatures
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8335ea0b1510f82592f710ce7e79b69a6ea8e9886f303bbe07c25b872c7a9484.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8335ea0b1510f82592f710ce7e79b69a6ea8e9886f303bbe07c25b872c7a9484.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.9MB
-
Filesize
7.4MB