Behavioral task
behavioral1
Sample
1492-58-0x0000000000400000-0x000000000085F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1492-58-0x0000000000400000-0x000000000085F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1492-58-0x0000000000400000-0x000000000085F000-memory.dmp
-
Size
4.4MB
-
MD5
db1d2b91e6a779b2a7118f6129eed213
-
SHA1
30c71c920038201f5b0103a10c32900ba20db859
-
SHA256
0faf49e2c19a5b10f745067d135903c9e08406e22bed1c04ce8f568dbd5dfd9e
-
SHA512
b22095df267c0fa31ef6395d1648848f5a24d9ec9ba08aef36a3626d1a22fa736bf6a9679165e771357c64f3116eb11a69697e152486ca7bf5a110f7e87f5333
-
SSDEEP
3072:RfSINxfpjy70ebdwhFBBgWknWP47dS4Y0CFBALwZZRwp1Wzyfq6vUgHmMuqgz7Fy:RraZmFBW3xXS+EBwazQq6vU89439T
Malware Config
Extracted
vidar
55.5
937
https://t.me/tg_turgay
https://ioc.exchange/@xiteb15011
-
profile_id
937
Signatures
-
Vidar family
Files
-
1492-58-0x0000000000400000-0x000000000085F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 201KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ