Overview

overview

10

Static

static

10

532-157-0x...ry.exe

windows7-x64

532-157-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    532-157-0x00000000002B0000-0x0000000000835000-memory.dmp

  • Size

    5.5MB

  • MD5

    09d2b45cc599e4ee76b3e9f4ca0238f1

  • SHA1

    ae7ce9f7b9f408b9f9d4a98a67ba772a5b92a288

  • SHA256

    5b4495895f42928721af5f6d9b8b1fa4f5bd47f48092a499a77de2117848716f

  • SHA512

    3e8e0444ba23c3472b14c4a9d4b456f0b2b814cc85453c1a35944e2f6f42ea3332e6b4b62fb40998a59058b4a0f4cbfa5227aab2a25fc99f2797f15e8cba144e

  • SSDEEP

    98304:f0WbDWKLFJiRzNEulqJLD/acA+aRdPI4PLtw7npX3gE1t6GRTZ:7mbEGk7o5gnpAg

Score
10/10
vmprotect5c24dc0e9726fcc756a18038ae4e0e67vidar

Malware Config

Extracted

Family

vidar

Version

3.5

Botnet

5c24dc0e9726fcc756a18038ae4e0e67

C2

https://steamcommunity.com/profiles/76561199497218285

https://t.me/tg_duckworld
Attributes
  • profile_id_v2

    5c24dc0e9726fcc756a18038ae4e0e67

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 532-157-0x00000000002B0000-0x0000000000835000-memory.dmp
    .exe windows x86


    Headers

    Sections