General

  • Target

    JaffaCakes118_d27659940a311717d0f0e391f70db08e

  • Size

    722KB

  • Sample

    250109-zz9twa1mhw

  • MD5

    d27659940a311717d0f0e391f70db08e

  • SHA1

    b6da01eead2328267fa37e2ad5f447ad247ca306

  • SHA256

    893421f408b421375de0053fb0ebebc9faec807df4a7bb9688a7cdf4b21d286e

  • SHA512

    60292d005fb667245cea19ffec6c1c579dd2fd8ae9e692a994dca8b13422376e96fbc43ba7d60d4ebd15b7bc9e4897291da6415849529bbae8a72a2d4ed07985

  • SSDEEP

    12288:SMa3KCLjwroscvJhW8Et+VKcS6WtoGvupFreEzKc7Npx2swZGEX8cA0/MU:2vLjiXcvLx5UCcoGWTUchpx0sEvl

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

517

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    517

Targets

    • Target

      JaffaCakes118_d27659940a311717d0f0e391f70db08e

    • Size

      722KB

    • MD5

      d27659940a311717d0f0e391f70db08e

    • SHA1

      b6da01eead2328267fa37e2ad5f447ad247ca306

    • SHA256

      893421f408b421375de0053fb0ebebc9faec807df4a7bb9688a7cdf4b21d286e

    • SHA512

      60292d005fb667245cea19ffec6c1c579dd2fd8ae9e692a994dca8b13422376e96fbc43ba7d60d4ebd15b7bc9e4897291da6415849529bbae8a72a2d4ed07985

    • SSDEEP

      12288:SMa3KCLjwroscvJhW8Et+VKcS6WtoGvupFreEzKc7Npx2swZGEX8cA0/MU:2vLjiXcvLx5UCcoGWTUchpx0sEvl

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Vidar family

    • Vidar Stealer

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks