Behavioral task
behavioral1
Sample
2668-507-0x0000000000400000-0x0000000000471000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2668-507-0x0000000000400000-0x0000000000471000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2668-507-0x0000000000400000-0x0000000000471000-memory.dmp
-
Size
452KB
-
MD5
16377f60e39cdec1336a5574bfb8f432
-
SHA1
ab65b6515a444167e67470420d8f89939ed89e23
-
SHA256
659082ab3b5473d8deb063f64f02a14737187db56099736a0cb4791e451e79d8
-
SHA512
de38633c39a0db742527e6c3a59663dbee40186afedeb0250e7729a7040f774d4c34bb8f7e32d8f12536f16d12d809f69e90a4644a17eb90b436140e421dc8f6
-
SSDEEP
6144:WNvC1zqSQz/E+KM9Lys1WIQuWyV3EszeC+SSXtSAUnUIbyC:WNvC1zqjETs1z/hVBzeC+SSXI0Iby
Malware Config
Extracted
vidar
5.4
25f5344bfcb62e75b7946c3a681aec54
https://t.me/vogogor
https://steamcommunity.com/profiles/76561199545993403
-
profile_id_v2
25f5344bfcb62e75b7946c3a681aec54
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2668-507-0x0000000000400000-0x0000000000471000-memory.dmp
Files
-
2668-507-0x0000000000400000-0x0000000000471000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ