Overview

overview

10

Static

static

10

2972-0-0x0...ry.exe

windows7-x64

1

2972-0-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2972-0-0x00000000008D0000-0x0000000000F93000-memory.dmp

  • Size

    6.8MB

  • MD5

    f681a3c698bbe7fdb3873a612f171dc3

  • SHA1

    8a22d7fb3fd279c77ad1be6c2af710576e47ad70

  • SHA256

    185f0577e2a81259e15dde7d9bf43f10429bab766278caa29cf86c58f111a19f

  • SHA512

    b8f3d3c085316939d3376f36b7519c37a5fc49a963aae14fa399cd5e8f786496f81a35979b233f0bad59a78a6f0734435a013ec909d0bea6ac054baa6e72c193

  • SSDEEP

    49152:YtCfdAJJwW4jYWVW/8XDJgZjcgH2YJkYxPj0n4XuRx0dLDp9+Wlbz1jiAkBAbdUT:YtsAT/8zOcyrtXu70JnZxji/BAbdS

Score
10/10
stealer32496ae0032d8cf6a9ae8bcc38eb2fd8vidarstealc

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

Version

10

Botnet

32496ae0032d8cf6a9ae8bcc38eb2fd8

C2

https://t.me/r8z0l

https://steamcommunity.com/profiles/76561199698764354
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Stealc family
    stealc
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2972-0-0x00000000008D0000-0x0000000000F93000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections