General

  • Target

    JaffaCakes118_f19f125c6355d85fcf8d1c2d5e5ce584a8f9c3d17c582060f9b8783836878fda

  • Size

    657.1MB

  • Sample

    241225-v5brta1jcp

  • MD5

    62ac3c7e7e39d0c9b95f157560b5aa34

  • SHA1

    6602ce66ce0dd9933b532dce83b84abfceefdde0

  • SHA256

    f19f125c6355d85fcf8d1c2d5e5ce584a8f9c3d17c582060f9b8783836878fda

  • SHA512

    7af61551872a3423450a43a2dbec9267f253ee25f39a703df9bf2a529333292141a5bf49a6d89cacf06c97b252f29194e2784a57d8469b6dc871870408f756a7

  • SSDEEP

    12582912:0QyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQjQyQyQyQyQyQyQyQyQyQ:0nnnnnnnnnnnnnnnnnnnnnEnnnnnnnnn

Malware Config

Extracted

Family

vidar

Version

4.8

Botnet

1ad01c34530f602a69a33e7eb523febe

C2

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531

Attributes
  • profile_id_v2

    1ad01c34530f602a69a33e7eb523febe

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Targets

    • Target

      JaffaCakes118_f19f125c6355d85fcf8d1c2d5e5ce584a8f9c3d17c582060f9b8783836878fda

    • Size

      657.1MB

    • MD5

      62ac3c7e7e39d0c9b95f157560b5aa34

    • SHA1

      6602ce66ce0dd9933b532dce83b84abfceefdde0

    • SHA256

      f19f125c6355d85fcf8d1c2d5e5ce584a8f9c3d17c582060f9b8783836878fda

    • SHA512

      7af61551872a3423450a43a2dbec9267f253ee25f39a703df9bf2a529333292141a5bf49a6d89cacf06c97b252f29194e2784a57d8469b6dc871870408f756a7

    • SSDEEP

      12582912:0QyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQjQyQyQyQyQyQyQyQyQyQ:0nnnnnnnnnnnnnnnnnnnnnEnnnnnnnnn

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Enterprise v15

Tasks