Behavioral task
behavioral1
Sample
1920-2-0x0000000000400000-0x000000000242E000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1920-2-0x0000000000400000-0x000000000242E000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1920-2-0x0000000000400000-0x000000000242E000-memory.dmp
-
Size
32.2MB
-
MD5
0f8207068dba0b1ef5fd4a05dde610b2
-
SHA1
677d8e2355d6cee1a69e717b6debcdd711c851dd
-
SHA256
9e78cc775638e07cd1726c3541cf9e3397f9c8d7c22e4fd45c23c810064d7333
-
SHA512
f060561d1b7b2346104316375403fff0aa61f19ff7a57128915a7241ddf795bd314a683d3ccd725a99acd907fbb34acbefe8be1c7be8556c8889b5b6a722aa98
-
SSDEEP
6144:+MCWtnciHP9qlr82FHFf+nH0WWogSLyBWgvxdBepKqUsTJGW6fo:+MBtnvslrDx+H0xoxUW4xdBepK4mo
Malware Config
Extracted
vidar
5.5
4c01b28ecbe8ea0b76de76fda027c366
https://t.me/macstoc
https://steamcommunity.com/profiles/76561199548518734
-
profile_id_v2
4c01b28ecbe8ea0b76de76fda027c366
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1920-2-0x0000000000400000-0x000000000242E000-memory.dmp
Files
-
1920-2-0x0000000000400000-0x000000000242E000-memory.dmp.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ