vidar | 1be4782dc3839c4ab537b7d5ce80601334de1d84f4be455db7c80b4ae3ec51ce

Sharing

Copy URL Twitter E-mail

General

Target

1be4782dc3839c4ab537b7d5ce80601334de1d84f4be455db7c80b4ae3ec51ce
Size

290KB
MD5

6fe01f3da170cd20be1c0fc082226ddf
SHA1

feacce4748c1b69f27c8917b3a61ac65cfe79194
SHA256

1be4782dc3839c4ab537b7d5ce80601334de1d84f4be455db7c80b4ae3ec51ce
SHA512

267f4c65f38e2ea15eb27a6e77be8bdcdcfce7020bf47e9a12d84eeebdfda22d68cdf301335ae0d22cf3ebb9e86d7d604f9f240f35b5141e2e66ff57da89348a
SSDEEP

3072:AYsC5IZ2xyrOePmfesrwmbk4wR92fA9wGWU/w3lYLt+E5okkR9wZlFl+NtVSQK+t:A8gzcr02sUfEWax1okxFyuQK+ZgHE

Score

10^/10

1259 vidar

Malware Config

Extracted

Family

vidar

Version

53.5

Botnet

1259

https://t.me/pegasusfly1

https://mas.to/@pavlenko349

Attributes

profile_id
1259

Signatures

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1be4782dc3839c4ab537b7d5ce80601334de1d84f4be455db7c80b4ae3ec51ce

Files

1be4782dc3839c4ab537b7d5ce80601334de1d84f4be455db7c80b4ae3ec51ce
.exe windows x86

8c50a8ce086310257ae68d43bbfc77c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
lstrlenA
lstrcatA
LocalAlloc
VirtualProtect
FindFirstFileW
FindNextFileW
CompareStringW
GetProcessHeap
SetEndOfFile
CreateFileW
CreateFileA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetTimeZoneInformation
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
ReadFile
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA

shlwapi

ord155

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

8c50a8ce086310257ae68d43bbfc77c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

Sections

.text Size: 208KB - Virtual size: 207KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 7KB - Virtual size: 84KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 208KB - Virtual size: 207KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 7KB - Virtual size: 84KB

.reloc
Size: 18KB - Virtual size: 18KB