Behavioral task
behavioral1
Sample
1992-59-0x0000000000400000-0x0000000000D3A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1992-59-0x0000000000400000-0x0000000000D3A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1992-59-0x0000000000400000-0x0000000000D3A000-memory.dmp
-
Size
9.2MB
-
MD5
fac39e2cbacc48e90f2ea37c29dc51d6
-
SHA1
24126a5ea8ae8cda62292d54ddcd864fe3dbefcb
-
SHA256
91be550b9ddcea9f9bdebeb1512f5d56a3a4d2d35d3e525a81c09b8b7ae5df7f
-
SHA512
5e020f4a74ea4daf22c0533063ab3b838d653470c46882bb55f14bb5070a06b9f18c32fb641ee368396a50662c6ad5cdd46331e0b69bfbd13f10c1e010e0da56
-
SSDEEP
196608:s808QyVG/1XJyfdxnixVzeV4kHyGYbtJ8+8rmocfDovm:s8OSG/tWdRuEV4kHsbtJ8+StcfEv
Malware Config
Extracted
vidar
55.5
1795
https://t.me/tg_turgay
https://ioc.exchange/@xiteb15011
-
profile_id
1795
Signatures
-
Vidar family
Files
-
1992-59-0x0000000000400000-0x0000000000D3A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 4.5MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 309KB - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE