Behavioral task
behavioral1
Sample
1000-229-0x0000000000400000-0x00000000005B0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1000-229-0x0000000000400000-0x00000000005B0000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1000-229-0x0000000000400000-0x00000000005B0000-memory.dmp
-
Size
1.7MB
-
MD5
8dd52c150bda1b0464ef582f59955f83
-
SHA1
73265e215586f7b0f6fc2fe5e823b6a60e626bb0
-
SHA256
1e1d13e0b751f38e2df7893cfd71204ae7e35049f6d254ac6d0a3247cd204ca6
-
SHA512
eed0619ab25179d95a5617f299f14e5d61f29be7f6416d3f0dde28c87163e66cdcfa1bab504275b1d5716df5dd96c726d0b27e28faa42c2c0db23aab108d155a
-
SSDEEP
3072:GT8IHnYWyQxaHybFrLjF6SCyFrAKo2ZnfQa5JKR+mMh7mFkDrrb0HqhU1amfoBjn:GTpfxjF6SCMemIQPmXi7ZhUEmCH6a2s
Malware Config
Extracted
vidar
55.2
1752
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
1752
Signatures
-
Vidar family
Files
-
1000-229-0x0000000000400000-0x00000000005B0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ