Behavioral task
behavioral1
Sample
de051fe9ba9c76553ebaed03175f827f827fc0905198acf5e73aa57fcd0db539.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
de051fe9ba9c76553ebaed03175f827f827fc0905198acf5e73aa57fcd0db539.exe
Resource
win10v2004-20241007-en
General
-
Target
5860c303d28de3b86750f4f643d14555.bin
-
Size
75KB
-
MD5
e507adf8c0efa6292c6f90e85fd3a9ec
-
SHA1
850666e7723799f96a0e7bf00bb952b60270ce3b
-
SHA256
a912c80394c5d6d83380dfbd76f851b711e2224aacfc2d5232b1e33bd91d1e3d
-
SHA512
503ebe7e6a8bfcdcf3df8e02a4b59e3ec3baa8f5fdc910669d85f6d9c6bddf93acbf7f3ce55349458a430f5a1021e7a93377e40b7fb15a0753fdb61af9e42b45
-
SSDEEP
1536:uJcL0yCNvxwVCKb1lT5mCWl6j9+/yvILv0S0+6Z5857IMPK:uMFCvxFKb1ZsCq6jQPQd+km7IUK
Malware Config
Signatures
-
Detect Vidar Stealer 1 IoCs
resource yara_rule static1/unpack001/de051fe9ba9c76553ebaed03175f827f827fc0905198acf5e73aa57fcd0db539.exe family_vidar_v7 -
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/de051fe9ba9c76553ebaed03175f827f827fc0905198acf5e73aa57fcd0db539.exe
Files
-
5860c303d28de3b86750f4f643d14555.bin.zip
Password: infected
-
de051fe9ba9c76553ebaed03175f827f827fc0905198acf5e73aa57fcd0db539.exe.exe windows:6 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
���.text Size: 16B - Virtual size: 1920.0MB
IMAGE_SCN_MEM_EXECUTE
���.rdat Size: 496B - Virtual size: 3264.0MB
IMAGE_SCN_MEM_READ
��@.data Size: 560B - Virtual size: 3584.0MB
IMAGE_SCN_MEM_READ
���.00cf Size: 8KB - Virtual size: 64.0MB
IMAGE_SCN_MEM_READ
��@.relo Size: 8KB - Virtual size: 2496.0MB
IMAGE_SCN_MEM_READ