General

  • Target

    4656-379-0x0000000000400000-0x000000000046C000-memory.dmp

  • Size

    432KB

  • MD5

    7e7b03c710e0bc77e152813d91157424

  • SHA1

    b7bb6fb7b6595ac9dc8f7ff8990e5d5403b5c174

  • SHA256

    2db1f0e97a294434a9b2f1bf8818ae6e304aa2f47cfbf541197f306f03933b10

  • SHA512

    ecd5b0ec2771d8eec13c6984a1e37d21c1c220f7c561651e605b869ef7b898cdd928b05fc197ea4adf98eb7a0c7511b91c463a75d642f57312a24c7d9503100a

  • SSDEEP

    6144:z66+X5aG78XAIn2RN2iy3g8UpioUb65qJfbri5bMuCV4abySqdBFJVkShVU:z6HX5aG782ook65G/id5CV5uvZVk

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

bf58e1879f88b222ba2391682babf9d8

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld

Attributes
  • profile_id_v2

    bf58e1879f88b222ba2391682babf9d8

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

Files

  • 4656-379-0x0000000000400000-0x000000000046C000-memory.dmp
    .exe windows x86


    Headers

    Sections