Behavioral task
behavioral1
Sample
1340-61-0x0000000000F30000-0x0000000001573000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1340-61-0x0000000000F30000-0x0000000001573000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1340-61-0x0000000000F30000-0x0000000001573000-memory.dmp
-
Size
6.3MB
-
MD5
e2860d91f3421473773d0bab022dd50e
-
SHA1
143de6a3a5a8a324bbc51b6d3d2cae44fc49a50d
-
SHA256
9aea86b7f917d3d405d53e58348294fba135be4334f7c5a4f421ef57d003a9f6
-
SHA512
0801daa53e6a1df3681464fab67e3e3f27450df6916fe43d85fb2ada13db6d5cc52fc07300695bc327b94442328afd7f17d03560f6220b45f3add3fd138b450b
-
SSDEEP
49152:9OTETmyIEA7/eFGEsEMSMjgqnEB/eYdqXmUKzWeJBagMfhMuy8FqtT3fzvs:ITiZIEa0vHMNgvXdwKSGs5pDqN3Lv
Malware Config
Extracted
vidar
54.6
1679
https://t.me/huobiinside
https://mas.to/@kyriazhs1975
-
profile_id
1679
Signatures
-
Vidar family
Files
-
1340-61-0x0000000000F30000-0x0000000001573000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 2.4MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE