Behavioral task
behavioral1
Sample
101832-135-0x00000000004D0000-0x000000000052E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
101832-135-0x00000000004D0000-0x000000000052E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
101832-135-0x00000000004D0000-0x000000000052E000-memory.dmp
-
Size
376KB
-
MD5
6311ca8c791778233db0c58d2c0de4c3
-
SHA1
51b549bf4122760d3e59de06f488c1cd79c77782
-
SHA256
bbeb4fce38eb8935edcc0eb1cba0e2b5402a7343c1c931e41c671b5d14ce57ab
-
SHA512
7e1bdec69f4326d58f86cdaad44980997c02a3730441ca1f547c8b887beb35558369a41346b70c91b3693f5587149461f76a427a23cb9c7c2b5800fd3f067fe4
-
SSDEEP
3072:ykN1PexA+eL5/GSbaky/ktr3AnCQG2pfuejHk32/Zu/rX8+4Wrrb0Hq1UYuS6xf:nLsSWRMtrSf/XjHrZiX8pQZ1U1J
Malware Config
Extracted
vidar
55.2
1707
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
1707
Signatures
-
Vidar family
Files
-
101832-135-0x00000000004D0000-0x000000000052E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ