General

  • Target

    78b309bb8f8aa1exeexeexeex.exe

  • Size

    335KB

  • MD5

    78b309bb8f8aa16ad5c1870075253cbd

  • SHA1

    f734a99799b37c33946b50e866f33673dbd3fb00

  • SHA256

    5e21391ba216a5d46e11789e4618fadfc37d54b2b32a12c6eb758da147a3b421

  • SHA512

    e7914756e675e1599672a832980c4322b60127ec84e59b33dd62e6c3a81599f03747f247294ab941f9ba7d8375aad8ae3ba224de5f887ec4bb2ecca77afb2d63

  • SSDEEP

    6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTK10qhh49Ajrt:qtUGfVwUFzRG6EQ0POfiTTC0qUAjrt

Malware Config

Extracted

Family

vidar

Version

4.2

Botnet

a81bcf59d85e6e13257840e65b9d1da8

C2

https://steamcommunity.com/profiles/76561199511129510

https://t.me/rechnungsbetrag

Attributes
  • profile_id_v2

    a81bcf59d85e6e13257840e65b9d1da8

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.38 Safari/537.36 Brave/75

Signatures

  • Vidar family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 78b309bb8f8aa1exeexeexeex.exe
    .exe windows x86

    1c84813089033efc0f55654edba31e01


    Headers

    Imports

    Sections