Overview

overview

10

Static

static

10

2008-72-0x...ry.exe

windows7-x64

2008-72-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    2008-72-0x0000000001330000-0x0000000001AC6000-memory.dmp

  • Size

    7.6MB

  • MD5

    3d6df6c64fa111d06844dabd9ea83bf8

  • SHA1

    67a318efff0a5bd2f0a8cae3ec4384e2cea4585d

  • SHA256

    84a1a55bbc53c7e07af655741a0abcd18cbb29d93a91b55d32e62e9201457fa8

  • SHA512

    ef490fd5915ead5a559e3d741f0f354d227b8e5477d90046a92aa1203757542f7327025b0260c74303830939630d39bc9c7788eccb01cc7816a63070db030104

  • SSDEEP

    98304:62llpitQt6E5PUeGjzt7184vUDPNwbo8thpncPKXnRwJgPRVPh1g09XjV4AvrqoP:WYWnztBPUCvLncP6nRwJoVngwXjVLqi

Score
10/10
vmprotect93847ac75331fcbc8340ae251ef2cc25vidar

Malware Config

Extracted

Family

vidar

Version

4

Botnet

93847ac75331fcbc8340ae251ef2cc25

C2

https://steamcommunity.com/profiles/76561199508624021

https://t.me/looking_glassbot
Attributes
  • profile_id_v2

    93847ac75331fcbc8340ae251ef2cc25

  • user_agent

    Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2008-72-0x0000000001330000-0x0000000001AC6000-memory.dmp
    .exe windows x86


    Headers

    Sections