Overview

overview

10

Static

static

10

4772-71-0x...ry.exe

windows7-x64

1

4772-71-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4772-71-0x0000000000400000-0x0000000000648000-memory.dmp

  • Size

    2.3MB

  • MD5

    82227025e75c200ee748a564c326046c

  • SHA1

    062f07fdc2e75527ded9f6f8996590de2bf2b1d0

  • SHA256

    9291806370c937bbfb59c1c9c4a1cabb7000c2938dcd5ad7a77d9f2ed99c2387

  • SHA512

    8e1e036a415ea31b212926b4aea4148ba12ed3ad59f8b9d79a91eb72fb808944b6d6af2b05e4899b501f590070fbae9afbcf03cd5c7664fb5968dd90eacd1b1e

  • SSDEEP

    3072:wqU3jcSWKLCUXqck+0iOR6F+FfKbybk1Y/UAoS2K8rs0VkB7:7U3QSWCPeiE6EFKj1Y/UTv7O

Score
10/10
stealerb5dee9a44edbf85a859e26e4b6a4fc26vidarstealc

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

10

Botnet

b5dee9a44edbf85a859e26e4b6a4fc26

C2

https://88.99.127.107

https://t.me/r8z0l

https://steamcommunity.com/profiles/76561199698764354
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Stealc family
    stealc
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4772-71-0x0000000000400000-0x0000000000648000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections