Overview

overview

10

Static

static

10

1384-155-0...ry.exe

windows7-x64

1384-155-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1384-155-0x0000000000160000-0x00000000006E5000-memory.dmp

  • Size

    5.5MB

  • MD5

    f4528b3653e15d4f03105d69d7a2f323

  • SHA1

    92fb585fe10e6f2d96de28d6bbcb07030d01b8fa

  • SHA256

    452553765b61cde2569848e4754a0a971501e84318b889429e9e41f6d9e7b9ee

  • SHA512

    8f6657588c6baa8f3f6d84121ae77750d02ffe1b422a2e38303c4532a4e3ca2f4083ff3832cfc756128fc23546b35316e870413458c604c7157d8eb705766dc5

  • SSDEEP

    98304:J4UbtSlY4PidTkxeQmJu2OLFHavJS/I6wLtw7npX1hqt9vVQ41:XPOxrxzNwgnpDW

Score
10/10
vmprotect5c24dc0e9726fcc756a18038ae4e0e67vidar

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

5c24dc0e9726fcc756a18038ae4e0e67

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld
Attributes
  • profile_id_v2

    5c24dc0e9726fcc756a18038ae4e0e67

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1384-155-0x0000000000160000-0x00000000006E5000-memory.dmp
    .exe windows x86


    Headers

    Sections