vidar | 2231160e71faf8674b8efc0cedf3384db3acc5d66f0276c76b18c7cb5f842ce0_unpacked[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2231160e71faf8674b8efc0cedf3384db3acc5d66f0276c76b18c7cb5f842ce0_unpacked.exe
Size

280KB
MD5

2bc296129698df69531a64b0911e2b6c
SHA1

c9c5cff6a7e700139d471b0116e12ea0bb17e98e
SHA256

595de5a664edf353ccca6e9e50899774eedf4733f1931b0e6e370d866de3e55a
SHA512

a5fdd3ecdc6ae4efa24d51668bdbdfc2609313f3d674a4546bb7e0a66d734b4e6fddf262802698628fba24271d4fbad9c20859f1ff8972169218bbd493d024c8
SSDEEP

6144:3NyBcukd1tiFqgFGI4pT2GI7DUiySpxQRqViGe:dyrmDiF3FuqDUiySGqVd

Score

10^/10

1672 vidar

Malware Config

Extracted

Family

vidar

Version

54.6

Botnet

1672

https://t.me/huobiinside

https://mas.to/@kyriazhs1975

Attributes

profile_id
1672

Signatures

Vidar family
vidar

Files

2231160e71faf8674b8efc0cedf3384db3acc5d66f0276c76b18c7cb5f842ce0_unpacked.exe
.exe windows x86

8253e8efea69f2acc297953b24cd5ada

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
lstrcatA
GetProcAddress
LoadLibraryA
lstrcmpA
MultiByteToWideChar
VirtualProtect
FindFirstFileW
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
FindNextFileW
lstrlenA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
CloseHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
WriteConsoleW

shell32

ShellExecuteA

crypt32

CryptStringToBinaryA

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

8253e8efea69f2acc297953b24cd5ada

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

crypt32

Sections

.text Size: 199KB - Virtual size: 199KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 7KB - Virtual size: 84KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 199KB - Virtual size: 199KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 7KB - Virtual size: 84KB

.reloc
Size: 19KB - Virtual size: 18KB