vidar | 3180-0-0x0000000000400000-0x0000000000676000-memory[.]dmp | Triage

Sharing

General

Target

3180-0-0x0000000000400000-0x0000000000676000-memory.dmp
Size

2.5MB
MD5

006dfa9154c20e14a99d29d1d0427b8e
SHA1

8cc4f17222219c2fce8e815600208b8b8fd6ade8
SHA256

803104be126128aa3878fa29fcc0875ce3691921c947363cc6147bb4e495dd67
SHA512

c842a05245782556919483de11c400d9d8d94933a6e89ad99d4dbf500880bd174deaa0313dfeb30d3d896eb5851a4c318a3d26f41ee5663584d6cdcf51a3b120
SSDEEP

6144:nyqNGGG6L+861M3ZY2Wc87mB0ZH8FNBa31154:yK7axupY2Wv7a0t8bS11

Score

10^/10

stealer vidar

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3180-0-0x0000000000400000-0x0000000000676000-memory.dmp

Files

3180-0-0x0000000000400000-0x0000000000676000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ