General

  • Target

    996-111-0x0000000000400000-0x000000000046A000-memory.dmp

  • Size

    424KB

  • MD5

    d8e7b548fb3f3829ead242c84188c76d

  • SHA1

    f4a212901933182f4d2fc6a87b99d9a515535654

  • SHA256

    74fbf8a2ce37645c7e729eef83e2511760bcf138d12c7d335e414354454578b3

  • SHA512

    1e615fa6fe3de11ab97b162be5f8c73f1513547c2a04ea2f2069dec02efdd0f3d840e170443bc02a64c2a5143697eb3ae16ccb9b0c14a0f33908d07de6d2d59c

  • SSDEEP

    6144:B9XMgWCxEV+JM6FhWbkQm8GEPkiU23dSFAiDD1TRuhTEA:LMgWCxzJMvzGKki/3giiDBTR4

Malware Config

Extracted

Family

vidar

Version

4.2

Botnet

8df2d40ab4f1e55964673105e15b3b82

C2

https://steamcommunity.com/profiles/76561199511129510

https://t.me/rechnungsbetrag

Attributes
  • profile_id_v2

    8df2d40ab4f1e55964673105e15b3b82

  • user_agent

    Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.38 Safari/537.36 Brave/75

Signatures

  • Vidar family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 996-111-0x0000000000400000-0x000000000046A000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections