Overview

overview

10

Static

static

10

3052-142-0...ry.exe

windows7-x64

3052-142-0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3052-142-0x0000000000AC0000-0x0000000000D19000-memory.dmp

  • Size

    2.3MB

  • MD5

    20e8adf9b1f2bc690e3e599bfc5924b6

  • SHA1

    931e076c31769a4c0f0e8e2b80338cd4a5f85d05

  • SHA256

    f52e406cf8caa8e57fa008e185157641754c9a7b7a22a05cbc94abb16a2a8516

  • SHA512

    e5f9ef13e624b69f39eecfc3ef0eae9b1841f62b9442c3a0a753211702c75223b2be6a17de13d6d9dcf3300e5802a5b440350962d6de325e0206d4c25f60716a

  • SSDEEP

    6144:/RYdKYIXXezTa5N1bd42QL0COCGA8iEAZZZZNrJ:/RYdKPd42WjOf7iB9

Score
10/10
stealer41d35cbb974bc2d1287dcd4381b4a2a8vidarstealc

Malware Config

Extracted

Family

vidar

Version

11.8

Botnet

41d35cbb974bc2d1287dcd4381b4a2a8

C2

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

  • Detect Vidar Stealer 1 IoCs
    stealer
  • Stealc family
    stealc
  • Vidar family
    vidar
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3052-142-0x0000000000AC0000-0x0000000000D19000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections