Behavioral task
behavioral1
Sample
2556-214-0x0000000000400000-0x00000000005B0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2556-214-0x0000000000400000-0x00000000005B0000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2556-214-0x0000000000400000-0x00000000005B0000-memory.dmp
-
Size
1.7MB
-
MD5
bfb7d30f9ffc9b688112ebda3cb694b2
-
SHA1
02171715d1f9fe070c55b1a808ab111bedfc6fd6
-
SHA256
2efca06b9a3fb94e0c581d064e0c5c56a57d834da6ca5a3a94c1ee5743393a8b
-
SHA512
fd301674e6970851597d099c2052887d59a7fb22d50a87c71e3dec18de928609e29032df21429247c3d53e9715387c333245e68bdf0b70dbaa6cf56d34554121
-
SSDEEP
3072:GT8IHnYWyQxaHybFrLjF6SCyFrAKo2ZnfQa5JKR+mMh7mIkDrrb0HqhU1amfoBPr:GTpfxjF6SCMemIQPmXB7ZhUEmC56k2s
Malware Config
Extracted
vidar
55.2
1752
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
1752
Signatures
-
Vidar family
Files
-
2556-214-0x0000000000400000-0x00000000005B0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ