General

  • Target

    2668-507-0x0000000000400000-0x0000000000471000-memory.dmp

  • Size

    452KB

  • MD5

    16377f60e39cdec1336a5574bfb8f432

  • SHA1

    ab65b6515a444167e67470420d8f89939ed89e23

  • SHA256

    659082ab3b5473d8deb063f64f02a14737187db56099736a0cb4791e451e79d8

  • SHA512

    de38633c39a0db742527e6c3a59663dbee40186afedeb0250e7729a7040f774d4c34bb8f7e32d8f12536f16d12d809f69e90a4644a17eb90b436140e421dc8f6

  • SSDEEP

    6144:WNvC1zqSQz/E+KM9Lys1WIQuWyV3EszeC+SSXtSAUnUIbyC:WNvC1zqjETs1z/hVBzeC+SSXI0Iby

Malware Config

Extracted

Family

vidar

Version

5.4

Botnet

25f5344bfcb62e75b7946c3a681aec54

C2

https://t.me/vogogor

https://steamcommunity.com/profiles/76561199545993403

Attributes
  • profile_id_v2

    25f5344bfcb62e75b7946c3a681aec54

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13

Signatures

  • Vidar family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2668-507-0x0000000000400000-0x0000000000471000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections