Overview

overview

10

Static

static

10

1580-18-0x...ry.exe

windows7-x64

1

1580-18-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1580-18-0x0000000000400000-0x0000000000649000-memory.dmp

  • Size

    2.3MB

  • MD5

    d2f2d2643661349019ae45f574723eff

  • SHA1

    bdcab302e3b59e797d7560c882898024f1d863cb

  • SHA256

    f15882e7ddbc299592c73614cc01f6a651abff23ec1decc571356a8183719da5

  • SHA512

    8b05989524dbf5f6fafb45352f45d050641bb64eedb1fc256a8fd3f1d22436b84ec1c6fbfb73d6b4a4d913e72cfc2ff4bb49d85383090603724828e976eac913

  • SSDEEP

    3072:J9tdngPNZFSDfevwsh9JML9cNaKrg0Jt+frhwx0pX1Ftp:Jjdn9ulhTWKNpIUKlFT

Score
10/10
stealerc9533453549e4a95f0288cf2424482e7vidarstealc

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

9.9

Botnet

c9533453549e4a95f0288cf2424482e7

C2

https://t.me/ta904ek

https://steamcommunity.com/profiles/76561199695752269
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Stealc family
    stealc
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1580-18-0x0000000000400000-0x0000000000649000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections