General
-
Target
240-127-0x0000000000400000-0x0000000000644000-memory.dmp
-
Size
2.3MB
-
MD5
5613925086650457c5fae55e16d0df34
-
SHA1
82bece0b31936338cc9127a98fc1c1d59164bd96
-
SHA256
a554c2857169e89f118e84166b028d7dabd4bc180ef7ec26a0fd9af9efcb9854
-
SHA512
c1c736f284f3f2cae730874f2467eb7ad47eeebfa0a716255932c465361b4260cb019ff02f602ee1bff32096b7c5ec0076be980f7fbc3bed04ecd9d8d5b7c3ce
-
SSDEEP
3072:hvzA6O0w5tsUTQsVgOc8yvY9emTKWBoynYenXZoLG3QXwwTWtlg5:hs50Itjks6Oc8ygNKDyYefOrCtlg5
Score
10/10
Malware Config
Extracted
Family
vidar
Version
7.8
Botnet
13bd7290c1961db27b4ede41bfbf4c5e
C2
https://t.me/karl3on
https://steamcommunity.com/profiles/76561199637071579
Attributes
-
profile_id_v2
13bd7290c1961db27b4ede41bfbf4c5e
-
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9
Signatures
-
Detect Vidar Stealer 1 IoCs
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
240-127-0x0000000000400000-0x0000000000644000-memory.dmp
Headers
Sections