Overview

overview

10

Static

static

10

1100-54-0x...ry.exe

windows7-x64

1100-54-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1100-54-0x0000000000130000-0x000000000075C000-memory.dmp

  • Size

    6.2MB

  • MD5

    3a9523a0785e4f89513621544fa83a80

  • SHA1

    91b14dc8ffaed365e4808187be6e54a838708630

  • SHA256

    94dafb14b8cf06c6244f34e6693231326f5fa31f4789b3629ade28c1b9151d14

  • SHA512

    6cbad275ca1599fdb3779b9a150215ad4609511e5687af75d0c0ccf558ebbec9a569007e6105843048c11a3b872a6ef371d4e97bc035bbbd8f1d6e40e80b3627

  • SSDEEP

    98304:m2Q6yGr1+ExsOeXcyfxJfCXNRbSXu0VjL9uEsYMti8BGb1iJY1EKTH:ISIFNtMzbSXuq068a1iWNT

Score
10/10
vmprotectbf57fe2fae2974604afc18ab750c7063vidar

Malware Config

Extracted

Family

vidar

Version

4

Botnet

bf57fe2fae2974604afc18ab750c7063

C2

https://steamcommunity.com/profiles/76561199508624021

https://t.me/looking_glassbot
Attributes
  • profile_id_v2

    bf57fe2fae2974604afc18ab750c7063

  • user_agent

    Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1100-54-0x0000000000130000-0x000000000075C000-memory.dmp
    .exe windows x86


    Headers

    Sections