Behavioral task
behavioral1
Sample
1452-152-0x0000000000F40000-0x00000000013C9000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1452-152-0x0000000000F40000-0x00000000013C9000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1452-152-0x0000000000F40000-0x00000000013C9000-memory.dmp
-
Size
4.5MB
-
MD5
e4c682ce4cdfeb4190da6f72fb0842da
-
SHA1
a8a68eb85d4487cb993e8dacdd8e347e0292d985
-
SHA256
5f832da565c67c08346ae22f721175b2c893390469d79c1c67f83395c860c47d
-
SHA512
c1e80388a227a8f9cec54dd90c7925bf0aa24413d19509ef7aeb794d27987d230385a1fd9b6c51b61737c000b870d754624f4ece46b99bb6231b2c2bd81d484b
-
SSDEEP
49152:G6EBIdG4hy5qwJamOLkiEsCV+83uj+hH5Uz1Ov2FpK:G6gHWs6LJEFV+v+x5URvv
Malware Config
Extracted
vidar
2.2
237
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Signatures
-
Vidar family
Files
-
1452-152-0x0000000000F40000-0x00000000013C9000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 1.5MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE