Overview

overview

10

Static

static

10

888-8-0x00...ry.exe

windows7-x64

888-8-0x00...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    888-8-0x0000000000400000-0x0000000000676000-memory.dmp

  • Size

    2.5MB

  • MD5

    a3f52b1b1c274d6d7049a41eb4191bd2

  • SHA1

    a8d824b8b7ba5a7fd6515b7cd1e981e71a18f23b

  • SHA256

    3b499eb5a1094ff21ae17e87da5ab3155df15147b90519ecc4e2f2dfc8234a2f

  • SHA512

    247796fa1eb005816968d2548e72e1e7e16fb99e08f93197f914a54a4e0f08d51409e0a3c45d8688c074bbca4c1f24e07b9f96aa6f85923a1e5305604052f933

  • SSDEEP

    6144:AE9LvJWKkDvmmpaCDu89bR0Vbux0R4kF/Y/o8+ey:AGRkD+nCD99N0Ix6BY/sey

Score
10/10
stealerd206c6aab5f4bd2208ca601fe157f31bvidar

Malware Config

Extracted

Family

vidar

Version

11

Botnet

d206c6aab5f4bd2208ca601fe157f31b

C2

https://t.me/maslengdsa

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 888-8-0x0000000000400000-0x0000000000676000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections