General

  • Target

    1916-355-0x0000000000400000-0x000000000046C000-memory.dmp

  • Size

    432KB

  • MD5

    88cab2713912aaddee099849aa45219c

  • SHA1

    bfed73eaa822ac1640e85c99123ac8690aa31bca

  • SHA256

    78768da7a877c0c0cf66bfd660651e5a12c3c6a87b67fbdd3b5e88d36d8aaf71

  • SHA512

    b600cbb4489ea050d70d50fe3f8dbf1eb2cb614f7700e2b7eceee04191fb05baf0258257f9379bb90bf92b6c40e7d3c3aa1f04dabbde58cbc20deafd88bf4802

  • SSDEEP

    6144:z66+X5aG78XAIn2RN2iy3g8UpioUb65qJfbri5bMuCV4aeSqdBFJVkShVU:z6HX5aG782ook65G/id5CV5evZVk

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

bf58e1879f88b222ba2391682babf9d8

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld

Attributes
  • profile_id_v2

    bf58e1879f88b222ba2391682babf9d8

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

Files

  • 1916-355-0x0000000000400000-0x000000000046C000-memory.dmp
    .exe windows x86


    Headers

    Sections