Overview

overview

10

Static

static

10

2988-14-0x...ry.exe

windows7-x64

3

2988-14-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2988-14-0x0000000000400000-0x0000000000646000-memory.dmp

  • Size

    2.3MB

  • MD5

    a9283abb2c2eeb5ccadf1625830260db

  • SHA1

    b7d322a13925376d65e79be084d657884ad88577

  • SHA256

    9baae6eb593b3015ec978766fbe4fa96662a6bc30fe7be8f20082d2d445fbe7a

  • SHA512

    1c7235711189da11ac48600e6dc1bdd10afe11fdbeff74e4714b6f2fb6d340035b9432c4885bdb55f18e9f6161d0a34357f2c388ea69f55388e9e1fc622510c6

  • SSDEEP

    3072:6f8yYNF9ex7nLydc8NwEfgjp9yuzKrDS+U+XC3bXM/1WXBQ:68yQF9QaOtnVzE6+SbWWXG

Score
10/10
stealer300583a3d34e2ebbfffc21e75992905cvidarstealc

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

9.7

Botnet

300583a3d34e2ebbfffc21e75992905c

C2

https://steamcommunity.com/profiles/76561199686524322

https://t.me/k0mono
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Stealc family
    stealc
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2988-14-0x0000000000400000-0x0000000000646000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections