Behavioral task
behavioral1
Sample
3748-202-0x0000000000400000-0x00000000005B0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3748-202-0x0000000000400000-0x00000000005B0000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3748-202-0x0000000000400000-0x00000000005B0000-memory.dmp
-
Size
1.7MB
-
MD5
c2a59ac0b305c25d3758832cbbc80549
-
SHA1
8b7562bf508b0159c8dcabb0ea117822a9f9e583
-
SHA256
f2aa70ce3979e1ac530ff8af6f897d3a7eea0f95f89bd4eed323477a018e94e4
-
SHA512
f081a9bd95117a01324a11039f8cfb0cc956b172bd57f4da9ce6329bcabb20793c2e57607983a93786cafa3e8bc5c9444d9a5c08d8e5db222a1d1373ddbc42cd
-
SSDEEP
3072:GT8IHnYWyQxaHybFrLjF6SCyFrAKo2ZnfQa5JKR+mMh7mzkDrrb0HqhU1amfoBFn:GTpfxjF6SCMemIQPmXY7ZhUEmC86Z2s
Malware Config
Extracted
vidar
55.2
1752
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
1752
Signatures
-
Vidar family
Files
-
3748-202-0x0000000000400000-0x00000000005B0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ