Overview

overview

10

Static

static

10

2764-154-0...ry.exe

windows7-x64

2764-154-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    2764-154-0x00000000005F0000-0x0000000000B75000-memory.dmp

  • Size

    5.5MB

  • MD5

    ea11c8431879e351382b6b277e2fb9e6

  • SHA1

    239e0c7b848ab017ea6ad0694af9875120b23c9e

  • SHA256

    7b5189914947c86909f2eac86c6ad62b10d9ca5df3e5eeb2dbe13c4f85783f17

  • SHA512

    9b2b7851969c529bd1437a37ef21fe2ba058dd8414f3b9aa7eae8104d7f0d4c7e99552d387b48a7f09226afe32fa61164afcae8cf651c69b49509b2065905240

  • SSDEEP

    98304:feWbPupv6EinzhgudzJHHT+oE2+ZR/IQwLtw7npXZ0oV1Oz73Z:EONgu9zkCgnpqR

Score
10/10
vmprotect5c24dc0e9726fcc756a18038ae4e0e67vidar

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

5c24dc0e9726fcc756a18038ae4e0e67

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld
Attributes
  • profile_id_v2

    5c24dc0e9726fcc756a18038ae4e0e67

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2764-154-0x00000000005F0000-0x0000000000B75000-memory.dmp
    .exe windows x86


    Headers

    Sections