General

  • Target

    4104-411-0x0000000000400000-0x000000000046C000-memory.dmp

  • Size

    432KB

  • MD5

    3dcfba540ef13facc14243c79548f3a1

  • SHA1

    fadb0ccc0a7f3385d18745bb233b62f12483daec

  • SHA256

    06aa08807aa8983c6503e3880621f779cc708a0bf6e04697a04c8fb17cac9db8

  • SHA512

    6f2a023228f0d4d1d05193d76536ee100ba91bcc16e22c08fea27ee570f4e6a6de902a30c3173e8379f55229386807d87719296eebf873ec9efe3f0a5ea032d9

  • SSDEEP

    6144:z66+X5aG78XAIn2RN2iy3g8UpioUb65qJfbri5bMuCV4afSqdBFJVkShVH:z6HX5aG782ook65G/id5CV5fvZVk

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

bf58e1879f88b222ba2391682babf9d8

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld

Attributes
  • profile_id_v2

    bf58e1879f88b222ba2391682babf9d8

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

Files

  • 4104-411-0x0000000000400000-0x000000000046C000-memory.dmp
    .exe windows x86


    Headers

    Sections