Overview

overview

10

Static

static

10

1240-5-0x0...ry.exe

windows7-x64

3

1240-5-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1240-5-0x0000000000400000-0x0000000000646000-memory.dmp

  • Size

    2.3MB

  • MD5

    f3fab02b4c8a544c81af3a65679a29f4

  • SHA1

    dfc3c92c7545aa2ed4ea9c2426aff19730e5e7c3

  • SHA256

    bb8e0b8f1ac835f3a875ff9a80b7445ba41c985fb30faed491f07577727bcecb

  • SHA512

    b2fedd94250b52e512aeab820a742274bc1553941e59f86813d2bbc03e6e12aa589dc7fa321022a0a994b808c721526910a6f6e0dfc516ab96b5be070b75f5a9

  • SSDEEP

    3072:tf8nGHElvZZT+4qXcHvuefUbgtvfYtgJerjCBUvk/HTNN:98nFlvCxBX2XYK0jUAATNN

Score
10/10
stealerc21b45a432889af65aa05cd66920d0a2vidarstealc

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

9.8

Botnet

c21b45a432889af65aa05cd66920d0a2

C2

https://steamcommunity.com/profiles/76561199689717899

https://t.me/copterwin
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Stealc family
    stealc
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1240-5-0x0000000000400000-0x0000000000646000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections