Overview

overview

10

Static

static

10

1364-155-0...ry.exe

windows7-x64

1364-155-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1364-155-0x0000000000620000-0x0000000000BA5000-memory.dmp

  • Size

    5.5MB

  • MD5

    9576d5a31054159bb4e9f26e31be28fb

  • SHA1

    4b37fc2dfe672cb9e7f196a8a6943a254bfabb7d

  • SHA256

    5de2c9777f45dac9955d3c649e070c346fbbf9d2459d007b7167dde2339a5c73

  • SHA512

    413012cf6c1e71ab586d84d30c4738bc8a8c86b3d03ef7bf592b7dc329dc7cddafe2f804150c4e100ec496cdf442318547751eea86d6911a1c0067a8e37dd464

  • SSDEEP

    98304:5rcb5ySY/hifr4leIDJyC63ZbKzhevIK7Ltw7npXX9WlV7TqMd:lUsljcLpXgnpdq

Score
10/10
vmprotect5c24dc0e9726fcc756a18038ae4e0e67vidar

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

5c24dc0e9726fcc756a18038ae4e0e67

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld
Attributes
  • profile_id_v2

    5c24dc0e9726fcc756a18038ae4e0e67

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1364-155-0x0000000000620000-0x0000000000BA5000-memory.dmp
    .exe windows x86


    Headers

    Sections