General
-
Target
1204-56-0x0000000000400000-0x00000000006A6000-memory.dmp
-
Size
2.6MB
-
MD5
552f93b9e5b9671453c6f029e0e68c07
-
SHA1
cdd9a51911c988862bddb450f240dc1d86a4e6c3
-
SHA256
701dcc37ca83fa16a106d79d1a646a1892a1caec8f8d306425ada21309960138
-
SHA512
89a4542b353fd84189da6b0e460edd0ed4f28025d6f5e5fe98485d55148b1277f76c5874d030599c0b7e53054796ff70ac299fbf77cb06992f7bb2980fe85ff4
-
SSDEEP
12288:Vw0nFX4V5rEbUsrfMckglyyDNL4F1DGHAp2:9lrMPg4ytaCgY
Score
10/10
Malware Config
Extracted
Family
vidar
Version
4
Botnet
667e85c8112da056f901292caf82b3ed
C2
https://t.me/looking_glassbot
http://23.88.46.113:80
https://steamcommunity.com/profiles/76561199508624021
Attributes
-
profile_id_v2
667e85c8112da056f901292caf82b3ed
-
user_agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1204-56-0x0000000000400000-0x00000000006A6000-memory.dmp
Headers
Sections