Behavioral task
behavioral1
Sample
1640-87-0x0000000000880000-0x0000000000F99000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1640-87-0x0000000000880000-0x0000000000F99000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1640-87-0x0000000000880000-0x0000000000F99000-memory.dmp
-
Size
7.1MB
-
MD5
9937d7b5e3ce7138767ecac4ff43dca4
-
SHA1
98c511e355d1a62619d605076cca68b409017fb9
-
SHA256
47e7b21c8d8d5eeed6c70c068459a5f9d8214f7e2994f25b3c454d0611876b0c
-
SHA512
9979cf89bd3b583e941eb4c35ee7dd50ffad9032b3f86e35a6cce29bc111aee8b8d81d903d7d53f0f1f764d772876f4995b001c69753508aaeb9e3b5389f5c91
-
SSDEEP
98304:ywECO8inO/u1GRLYGVh9PcS3BHCDiZEQBs2x4uF/e:/Of+2uBX9PcmHCOEyyuU
Malware Config
Extracted
vidar
55.7
1829
https://t.me/deadftx
https://www.tiktok.com/@user6068972597711
-
profile_id
1829
Signatures
-
Vidar family
Files
-
1640-87-0x0000000000880000-0x0000000000F99000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 2.6MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE