General

  • Target

    JaffaCakes118_8092bbb69c4fac487ec5356e69a2b5adf9983e4521f1c465a3355aa9b9de37c9

  • Size

    1.1MB

  • Sample

    241229-k4pbeaxrdv

  • MD5

    983f11c521c358462945941c58beeb34

  • SHA1

    e65a4cf2c73cc766e4ea9fffd4682547a4b88b1b

  • SHA256

    8092bbb69c4fac487ec5356e69a2b5adf9983e4521f1c465a3355aa9b9de37c9

  • SHA512

    6946c2102b33e0bcc8f136f4341786985ba3ab2f3dfd82989014f503d3d56cfba3c30922721217398485b880ca4adfbe19813c776a74d2ccba30c29dce0facbd

  • SSDEEP

    12288:5YWmdEdjwyBiIPl/dEah1iIvlU2n2P28j0aIeRl+/yrtGBN8de6NtxU+mxgw:5sKEyo69dh1iIvye8IDok6YC/dJw

Malware Config

Extracted

Family

vidar

Version

51.5

Botnet

1171

C2

https://t.me/hi20220403

https://mastodon.social/@sam5al

Attributes
  • profile_id

    1171

Targets

    • Target

      JaffaCakes118_8092bbb69c4fac487ec5356e69a2b5adf9983e4521f1c465a3355aa9b9de37c9

    • Size

      1.1MB

    • MD5

      983f11c521c358462945941c58beeb34

    • SHA1

      e65a4cf2c73cc766e4ea9fffd4682547a4b88b1b

    • SHA256

      8092bbb69c4fac487ec5356e69a2b5adf9983e4521f1c465a3355aa9b9de37c9

    • SHA512

      6946c2102b33e0bcc8f136f4341786985ba3ab2f3dfd82989014f503d3d56cfba3c30922721217398485b880ca4adfbe19813c776a74d2ccba30c29dce0facbd

    • SSDEEP

      12288:5YWmdEdjwyBiIPl/dEah1iIvlU2n2P28j0aIeRl+/yrtGBN8de6NtxU+mxgw:5sKEyo69dh1iIvye8IDok6YC/dJw

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Vidar Stealer

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks