Overview

overview

10

Static

static

10

1908-402-0...ry.exe

windows7-x64

1908-402-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1908-402-0x0000000000800000-0x0000000000D85000-memory.dmp

  • Size

    5.5MB

  • MD5

    d165605365bf61dc562325b6d8107256

  • SHA1

    9b82eb19ad59f4526a333ea23a6ced88d81df6f3

  • SHA256

    085376768eded1c6dff6ed6edda26911b12aa7f87780e3e69dd216529d9ceb42

  • SHA512

    2c83ee8ee135e5183e84652e2a3ce16b799ad3c09a32224dfe20bb7ab13a4d464b2e04eea3402d865e2c57f36eff35bab5954433b4b7ee15ba53fa795cea5631

  • SSDEEP

    98304:h38b5qIiNXiXTSLeq/JIcsJfhKZ1IXI6xLtw7npXjLKVpVhce1:1EGLJyDHhgnpnW

Score
10/10
vmprotect5c24dc0e9726fcc756a18038ae4e0e67vidar

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

5c24dc0e9726fcc756a18038ae4e0e67

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld
Attributes
  • profile_id_v2

    5c24dc0e9726fcc756a18038ae4e0e67

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect

Files

  • 1908-402-0x0000000000800000-0x0000000000D85000-memory.dmp
    .exe windows x86


    Headers

    Sections