Overview

overview

10

Static

static

10

1300-75-0x...ry.exe

windows7-x64

1300-75-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1300-75-0x0000000000CD0000-0x0000000001713000-memory.dmp

  • Size

    10.3MB

  • MD5

    ad610e0e6680fcfd4b0cc86e34a96ca7

  • SHA1

    021906849078bf6d3c378fa92f1b1afd8517fedd

  • SHA256

    4fdc7d770003fa5f28e1a7cb801ef0bb8de4724e0ae60b5376c7bb6a02d63faa

  • SHA512

    ba1d43bdb352cf6be496c46375d2157a0ab2fcb4b154e3b47724f50b50afd75af2c541a4371be1bea14c70c79f3d211634f8affb5e6cc57ae280768595b457a1

  • SSDEEP

    196608:NL7WOhGFqMD3bTVoA6wrdFL+FrasjUn8yYl8wugVuxxuRvsvfo:Xu9zSwhFMraoU8yUgA8o

Score
10/10
vmprotectc46faa70a744f9fd08377be9a67c391cvidar

Malware Config

Extracted

Family

vidar

Version

4.5

Botnet

c46faa70a744f9fd08377be9a67c391c

C2

https://steamcommunity.com/profiles/76561199520592470

https://t.me/motafan
Attributes
  • profile_id_v2

    c46faa70a744f9fd08377be9a67c391c

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/111.0

Signatures

  • Vidar family
    vidar
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1300-75-0x0000000000CD0000-0x0000000001713000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections