vidar | 1568-0-0x0000000000400000-0x0000000000657000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1568-0-0x0000000000400000-0x0000000000657000-memory.dmp
Size

2.3MB
MD5

42f766a4f0bff1656ed2056c95b6db95
SHA1

43931984c4c6125849f391668ffcd15281d0b215
SHA256

9e96105cfeed4601126155dacf7196a4367223a0db5edc5cc3fa98adedb6e107
SHA512

4af2925cd81918762a3be4661e69788c9d5fbaf0b88c13f7ad4326669cdd711e7500a02007b586d23809f81ea3fbc05d0e0221b078ce3a567b9c944ad5eec5e4
SSDEEP

3072:oR+9MwiQ1/d0kzv4NmVcc18DM74+c9JDpdN3f5Bl5xoaq0jpp8HraqVmQ:oRKMreKkzwNemDM7Ab3im8F

Score

10^/10

stealer vidar

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1568-0-0x0000000000400000-0x0000000000657000-memory.dmp

Files

1568-0-0x0000000000400000-0x0000000000657000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ