Behavioral task
behavioral1
Sample
1820-3-0x0000000000400000-0x00000000007D3000-memory.exe
Resource
win7-20231023-en
General
-
Target
1820-3-0x0000000000400000-0x00000000007D3000-memory.dmp
-
Size
3.8MB
-
MD5
6bfd40e3f156bf51e950b29c0f891cd2
-
SHA1
6c9ca8301bd05069553edf47e5731553af313771
-
SHA256
43cd1e12828d7e6c9bf16972e62d77466953701c5029ede496a77f08fc678a50
-
SHA512
c1f0e0e410bb5ab11572a76528e5c2459969aead506540eaa519213df9b2864747319551b9e5096b9df5fcdb4fe12a662a85d1113698f5b97755fb37c77dd2e1
-
SSDEEP
3072:ffysv34+VEjY9c5WuSIfSJKTuz1F/nMR8yPUxcrmnUlnrnTfmJ/qIsn8qqVnCdBw:ffyKE89+WyPTuz70R8yTnrjQQhp
Malware Config
Extracted
vidar
6.7
52d67d34ad338b1aab9d89c0da5a59b1
https://t.me/s4p0g
https://steamcommunity.com/profiles/76561199575355834
-
profile_id_v2
52d67d34ad338b1aab9d89c0da5a59b1
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1820-3-0x0000000000400000-0x00000000007D3000-memory.dmp
Files
-
1820-3-0x0000000000400000-0x00000000007D3000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ