Extracted

• • Target

    JaffaCakes118_de3f1fd0fbd8e2527b0df2a8a42e9bee8b7e498c75a0da57acd5d2db275476c6

  • Size

    833.6MB

  • MD5

    e249a985e3fe64f1a4b714ddfca27459

  • SHA1

    9adc1168b991e798f685b6ae10cf507dba3b080d

  • SHA256

    de3f1fd0fbd8e2527b0df2a8a42e9bee8b7e498c75a0da57acd5d2db275476c6

  • SHA512

    3b4612473dc0e150894ca40b4cc9276a500fff4222473984ef5cf9501bdaa44f3397503b6956ed7a600333b4382fa61688194b9e74fa2f1d5568200f15d00a9c

  • SSDEEP

    98304:FH5/B8ao6KIbiyueYSTRvWkeUQPNPapIFsIHOFBEJ2RFnLiYw:FkTY6THVJ2RFnP

  Score

  10^/10

  vidar1911bootkitdiscoveryevasionpersistencestealertrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2