Overview

overview

10

Static

static

7

JaffaCakes...c8.exe

windows7-x64

10

JaffaCakes...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bdd4eca6d82e080f8bc77754bf11743655a571cc3fdd8c7f182d23145b200ac8

  • Size

    796.7MB

  • Sample

    241225-vw35pszqdl

  • MD5

    84fcc90b0146a0fc3c63ee830e8e9b1a

  • SHA1

    d8150d089f8a29cbd51966c435385285ecc2d7de

  • SHA256

    bdd4eca6d82e080f8bc77754bf11743655a571cc3fdd8c7f182d23145b200ac8

  • SHA512

    93cc8b28ac148f4190c2e8a1e21d1a00b83e2340c38c1845d844a41ab5b01a0952d8dda0e7f9a6331a9e63b3b33d20ac41ad76eff53f580013fda1b7af93f9b9

  • SSDEEP

    25165824:Mnnnnnnnnnnnnnnnnnpnnnnnnnnnnnnnnnnnpnnnnnnnnnnnn:Mnnnnnnnnnnnnnnnnnpnnnnnnnnnnnnp

Score
10/10
vidardb9dbe246aa5e0e35d3d0b52797ad04bdiscoveryevasionstealerthemidatrojan

Malware Config

Extracted

Family

vidar

Version

5.1

Botnet

db9dbe246aa5e0e35d3d0b52797ad04b

C2

https://steamcommunity.com/profiles/76561199536605936

https://t.me/vookihhfd

https://t.me/booliiksws

https://t.me/tatlimark
Attributes
  • profile_id_v2

    db9dbe246aa5e0e35d3d0b52797ad04b

Targets

    • Target

      JaffaCakes118_bdd4eca6d82e080f8bc77754bf11743655a571cc3fdd8c7f182d23145b200ac8

    • Size

      796.7MB

    • MD5

      84fcc90b0146a0fc3c63ee830e8e9b1a

    • SHA1

      d8150d089f8a29cbd51966c435385285ecc2d7de

    • SHA256

      bdd4eca6d82e080f8bc77754bf11743655a571cc3fdd8c7f182d23145b200ac8

    • SHA512

      93cc8b28ac148f4190c2e8a1e21d1a00b83e2340c38c1845d844a41ab5b01a0952d8dda0e7f9a6331a9e63b3b33d20ac41ad76eff53f580013fda1b7af93f9b9

    • SSDEEP

      25165824:Mnnnnnnnnnnnnnnnnnpnnnnnnnnnnnnnnnnnpnnnnnnnnnnnn:Mnnnnnnnnnnnnnnnnnpnnnnnnnnnnnnp

    Score
    10/10
    vidardb9dbe246aa5e0e35d3d0b52797ad04bdiscoveryevasionstealerthemidatrojan

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks