General
-
Target
2820-3-0x0000000000400000-0x0000000001A36000-memory.dmp
-
Size
22.2MB
-
MD5
7c314eb8b12cadfbf0333448b81f2753
-
SHA1
8aea1ea54d5dc6dc44ce434602f11df3492cdecc
-
SHA256
9b7a38cc30bb25e9fae313790a5500389282d851a29e7ce91e4e028ba750b60c
-
SHA512
9707fc27412b30994dc1b3dff99419726dec966e0061dbd582baf32b3ef0a84c57536ee7c43e1e9a7057ce287ad77e0d5783203f973d6d9c6efe9893980636dc
-
SSDEEP
6144:c0kKo4yxIoqUOnUk4GIt9D2U6ooST7V+:e2b5hIt1JoiY
Score
10/10
Malware Config
Extracted
Family
vidar
Version
8
Botnet
b8a5ebfe4a0abceff8d2cd1a6c6c4024
C2
https://steamcommunity.com/profiles/76561199644883218
https://t.me/neoschats
Attributes
-
profile_id_v2
b8a5ebfe4a0abceff8d2cd1a6c6c4024
-
user_agent
Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78
Signatures
-
Detect Vidar Stealer 1 IoCs
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2820-3-0x0000000000400000-0x0000000001A36000-memory.dmp
Headers
Sections