Analysis
-
max time kernel
7s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d111d4092dfac21e2de0cfc868b4fc5.exe
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
4d111d4092dfac21e2de0cfc868b4fc5.exe
-
Size
653KB
-
MD5
4d111d4092dfac21e2de0cfc868b4fc5
-
SHA1
c9017cc3b8b90e61c3f9eadeab4399264ae67727
-
SHA256
4ddb07c2e42dc5505d734dbb196c5518b4537b3c8695ecdf44ca87e4b2391ceb
-
SHA512
a1bac5362c8a8839cd0f74b9220b5c3de3f1a1118a5702ee0adfdb854c4ab30f08aa88e2bf7c1f5fe8dd6fc98c097971871428a7cbc06bd0d8ff08cf1de8b6ef
-
SSDEEP
12288:F8iMc6N2YsQAymDIQLt/ppW3E/TsqNKlZ+qSHnyRwJ2FALrW1i3JF9:B6N2Y6zL1jW38lNKlZqHpJxrl39
Malware Config
Extracted
Family
vidar
Version
39.7
Botnet
706
C2
https://shpak125.tumblr.com/
Attributes
-
profile_id
706
Signatures
-
Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/232-2-0x0000000002290000-0x000000000232D000-memory.dmp family_vidar behavioral2/memory/232-3-0x0000000000400000-0x00000000004BF000-memory.dmp family_vidar behavioral2/memory/232-13-0x0000000000400000-0x00000000004BF000-memory.dmp family_vidar behavioral2/memory/232-14-0x0000000000400000-0x00000000004BF000-memory.dmp family_vidar behavioral2/memory/232-16-0x0000000002290000-0x000000000232D000-memory.dmp family_vidar