General

  • Target

    2728-107-0x0000000000400000-0x0000000000466000-memory.dmp

  • Size

    408KB

  • MD5

    644edd05daa132f74d76a3faadfb415d

  • SHA1

    c5a12f711f41e84eae699bfe7f4eb00b45b9fa8e

  • SHA256

    8ce9e5fbf8da071e00842d802b28ca272e5fed55da850ac6ef3775740509e868

  • SHA512

    4a63f983fc34bf66a3849e26b8e310dfba529f6024cbca377b493ca96530489ad64656c05e483610b5bb52977061513e88a50f3f7b3fae2c2b6a440bddbd2e11

  • SSDEEP

    6144:MA+1e4b30YI1zA7I4ucur1srMPOZcFiIRs/hxjppXD3PlsEL:KXbkSlNrmOZcFi2sPXDN1

Malware Config

Extracted

Family

vidar

Version

5.9

Botnet

74f32cde453e54f100cc2d48d465781c

C2

https://steamcommunity.com/profiles/76561199557479327

https://t.me/grizmons

Attributes
  • profile_id_v2

    74f32cde453e54f100cc2d48d465781c

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 OPR/104.0.0.0

Signatures

  • Vidar family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2728-107-0x0000000000400000-0x0000000000466000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections