General

  • Target

    2160-54-0x0000000001380000-0x00000000013F0000-memory.dmp

  • Size

    448KB

  • MD5

    9ea99837b788bd15a4a9ae7743bab5fe

  • SHA1

    109582953ea56aa44d0626ae964e2e5884dfa91d

  • SHA256

    1042f24d879aed6c14a784a967a6a933c075a1aea0153028e1312fe94ba0a254

  • SHA512

    843ee8f33718eaad4ded388fa1bf361cf64b7d864960d4690ddeaeaab59442cc61675a94b924a590b3202706165a4c14cb363a2aa93dc516ff7ec34240f87c3c

  • SSDEEP

    6144:9Uyr59jI6CJQlJe7xi9QoAp5I2y3AzSWWzFaKhwzKNKxkyoS:yyr5q6CnQ9pAPI2uAzmaR3oS

Malware Config

Extracted

Family

vidar

Version

4.2

Botnet

94aa71fd28602a425cfb539e40cc03dd

C2

https://steamcommunity.com/profiles/76561199511129510

https://t.me/rechnungsbetrag

Attributes
  • profile_id_v2

    94aa71fd28602a425cfb539e40cc03dd

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.38 Safari/537.36 Brave/75

Signatures

  • Vidar family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2160-54-0x0000000001380000-0x00000000013F0000-memory.dmp
    .exe windows x86


    Headers

    Sections