General

  • Target

    3388-505-0x0000000000400000-0x000000000046C000-memory.dmp

  • Size

    432KB

  • MD5

    1114d3faef4263b5e1f5f0d92184e98a

  • SHA1

    467dd193d1e58c25d3e78398aa562f57a313ac5f

  • SHA256

    003fa14542188a91fc45e9f1c4af58198b845abed3a5bd9878e14ce3d3e178f6

  • SHA512

    8ba62d6ec56f543d63248210af364446739bc2abf7f4df3437e992d7a4c15fa6816f3857577d373392e4f1ddcab6f826b0028243f330be16ccaf95d79b42a836

  • SSDEEP

    6144:z66+X5aG78XAIn2RN2iy3g8UpioUb65qJfbri5bMuCV4aqSqdBFJVkShVH:z6HX5aG782ook65G/id5CV5qvZVk

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

bf58e1879f88b222ba2391682babf9d8

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld

Attributes
  • profile_id_v2

    bf58e1879f88b222ba2391682babf9d8

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

Files

  • 3388-505-0x0000000000400000-0x000000000046C000-memory.dmp
    .exe windows x86


    Headers

    Sections