Behavioral task
behavioral1
Sample
4348-199-0x0000000000400000-0x000000000045C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4348-199-0x0000000000400000-0x000000000045C000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4348-199-0x0000000000400000-0x000000000045C000-memory.dmp
-
Size
368KB
-
MD5
78e693252ae248256fd7c5e11d5202a5
-
SHA1
901609ca998dfe07e8535a6b8543e51af4edb906
-
SHA256
c92728f09e70a38335b9f54a9702506bcd648b880c722af83641284f4421cfc8
-
SHA512
661010c3b855840316d4dfb8c3a14ef9e81516974ac8eee85ae8aa981fc4e4963b46d9c4013038bf6c164cd494d2866846777104d84e4d0e780b480c3a10bb29
-
SSDEEP
3072:NfSINxfpjy70ebdwhFBBgWknWP47dS4Y0CFBALwZZRwp1Wzvmfq6lUgHmv47F3:NraZmFBW3xXS+EBwazMq6lUfY3
Malware Config
Extracted
vidar
55.5
517
https://t.me/tg_turgay
https://ioc.exchange/@xiteb15011
-
profile_id
517
Signatures
-
Vidar family
Files
-
4348-199-0x0000000000400000-0x000000000045C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 201KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ