Behavioral task
behavioral1
Sample
1380-153-0x0000000000270000-0x00000000006F9000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1380-153-0x0000000000270000-0x00000000006F9000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1380-153-0x0000000000270000-0x00000000006F9000-memory.dmp
-
Size
4.5MB
-
MD5
9f631e3b9d45ccd8c8039e10c01ae0a6
-
SHA1
a3b27a9450f20745b6ac0d5fd86959daad8284a1
-
SHA256
6c689ea9e85e7398a9fe29b370a27c704eee2d2cf5a7759b105093a864d8447d
-
SHA512
5c50d670da2e24efa0b952129d9314ea60f290ea9cba7cfb7bb77d3992ec87fac500e4d8e8de82c78e208137f90e6507ac21df82ee247ab1cb7fa22f8747c285
-
SSDEEP
49152:E1kl5l81Wy5qZw20oLkBEsCV+83uj+hH5Uz1OvZFpK:E1qm4l1LuEFV+v+x5URIv
Malware Config
Extracted
vidar
2.2
237
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Signatures
-
Vidar family
Files
-
1380-153-0x0000000000270000-0x00000000006F9000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 1.5MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE