General

  • Target

    Cinema4dFull2022.rar

  • Size

    7.3MB

  • MD5

    96443dfb2ae8cc0484ff95e6e454d72f

  • SHA1

    3052f0105691ff938134276609cd2690e9bfbbf2

  • SHA256

    ee9bd772a98e17735cee6c6a66592246014fa068e119ce76715639fe82d73833

  • SHA512

    518ec33524a3f9afc0f8518dcd621e95ca2e96d4acc21c56d53ae02506c68a7eb11d6f26cee3550cfb372786a259f1fdf53c14ad995b2797df354f7845e1b35c

  • SSDEEP

    196608:qOHG3Xl0A7GAhLhVy5U282GP9etFS4X7vf9qXZcEk/u:XGHlrXRb2o9pMvfYcEk2

Malware Config

Extracted

Family

vidar

Version

4.6

Botnet

354a5bace89e5525b2ca2da74419f05a

C2

https://steamcommunity.com/profiles/76561199523054520

https://t.me/game4serv

Attributes
  • profile_id_v2

    354a5bace89e5525b2ca2da74419f05a

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0

Signatures

  • Vidar family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Cinema4dFull2022.rar
    .rar

    Password: 1896

  • HwidProtector.dll
    .dll windows x64

    Password: 1896

    c8820c92458429ac52b291ca51bad0e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows x86

    Password: 1896

    8f734ad2a2d1a7b5910aa87f16fd104e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Security.dll
    .dll windows x86

    Password: 1896

    140ea1a2783378133a762a7bc41e492d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Setup.exe
    .exe windows x86

    Password: 1896

    c25e383e860883b8942e1c5dcdf05eb9


    Headers

    Imports

    Sections

  • borlndmm.dll
    .dll windows x86

    Password: 1896

    7028057a1895f8e9d0c743af27770b1a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cc32100mt.dll
    .dll windows x86

    Password: 1896

    8c6b03eae8fd279390ca970d47f5e142


    Headers

    Imports

    Exports

    Sections

  • dbghelp.dll
    .dll windows x86

    Password: 1896

    f7cb4432172d116632abc77471a1a600


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libEGL.dll
    .dll windows x86

    Password: 1896

    48c72c12b3685003a84e2caf235b2330


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • newsocket.data
  • opengl32sw.dll
    .dll windows x86

    55466abe52f1bf0d8df45beaffd68bf3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • qt_de.qm
  • qt_fr.qm
  • qt_ru.qm
  • qt_uk.qm
  • readme.txt
  • udate-settings.ini
  • udpater.ini