General

  • Target

    2812-478-0x0000000000400000-0x0000000000643000-memory.dmp

  • Size

    2.3MB

  • MD5

    07f005b352e0da7481a9ed80524b2131

  • SHA1

    c2e2856998a0a5bd1b63be376c06da450b35539b

  • SHA256

    f2b3b9f54c206233d20b5d4f9713b9f5cd51204dfe8dee426c37a4aa0b117d4f

  • SHA512

    89a61f0fed00a05ed81f0061a368dca899c426ce59909f52f2d9d80d7a671dd1e650c6d2641d074786a8e15dcc1217209cf726ea230247a3fcd9e9e06f9394d0

  • SSDEEP

    6144:TsHPY7hsyvEBr3cQEKmnMGbK6j6zISI7uU2S:TszysqFnM06zVS

Malware Config

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

C2

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes
  • profile_id_v2

    1b9d7ec5a25ab9d78c31777a0016a097

Signatures

  • Detect Vidar Stealer 1 IoCs
  • Vidar family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2812-478-0x0000000000400000-0x0000000000643000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections