Behavioral task
behavioral1
Sample
708-71-0x0000000000400000-0x0000000000E3D000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
708-71-0x0000000000400000-0x0000000000E3D000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
708-71-0x0000000000400000-0x0000000000E3D000-memory.dmp
-
Size
10.2MB
-
MD5
afe4cc26daac435622db246b169d5efc
-
SHA1
5f699932f3f00a8ba16c856b88a24c9c96c7a690
-
SHA256
f6a3c35c2e00ba8912d3d4e337372fddede9b083f31aaa4ed81443d7ab560b55
-
SHA512
973c763afa9402df4d6abe3b0e5d3ff06cf71356cb966b54f668c3de4a97e87d984a574f8fc2f8e1594654ae6693427ffcc43f80d69cbd9fc6e5893f7e7cd2c2
-
SSDEEP
196608:3F+PZEhwR7A1cWal+UHe6TaS7qgZNEVbyNQKAzg6:3kxEhwR7dl+UTTaS7vZNIyNQKAzg6
Malware Config
Extracted
vidar
54.9
1707
https://t.me/larsenup
https://ioc.exchange/@zebra54
-
profile_id
1707
Signatures
-
Vidar family
Files
-
708-71-0x0000000000400000-0x0000000000E3D000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.:T. Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zO} Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.D|B Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 430KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ