Malicious
Malicious

58f7750a1d90245d1099027d086a4464

PE Executable
|
MD5: 58f7750a1d90245d1099027d086a4464
|
Size: 8.65 MB
|
application/x-dosexec


Print
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
Hash Value
MD5
58f7750a1d90245d1099027d086a4464
Sha1
54c7ccc757627ef8318bd503da4dd84503349943
Sha256
d4e52baac054cee9ed04194dee97bd4352c1ab686659434faa42d5524733c96b
Sha384
3dc20d144942ec022135725711601cdf33d0422ab3eccdbecfc3d380d123f382f69e2f623a7f12d0c23ac663a46f1b57
Sha512
c402d66e0ce9bd4d5d5759604b58864bc2778d4089a82ed572771e9bd202cc386504ca4322990defcfd114ec879300b28b802f1435883c13ed1c5ab1c05edf70
SSDeep
98304:eY8jCtNJVy/P9geDlT6KxDvPlDTQcA1sIG5+qe/fK:H4CqnlT6KxDvPlDT/fe6
TLSH
D2966C12BB9941ECD1BBC034D2564637EA7130DA0B34ABEB85C48A692F66FF45E3C354

PeID

MASM/TASM - sig4 (h)
Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
File Structure
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Malware Configuration - Vidar Config. Remote Dll Download #1
Config. Field
Value
C2

https://steamcommunity.com/profiles/76561199872628623/7[DEBUG] ?????????????? ?????????????? ??????????????: '?' �[DEBUG] ???? ?????????????? ???????????????? ??????????????, ???????? 1 ?????????????? ?????????? ?????????????????? ????????????????... :mem

Botnet

ory:CREATE TABLE random_entries ( id INTEGER PRIMARY KEY, random_value INTEGER NOT NULL, timestamp TEXT NOT NULL )[DEBUG] ???????????? ?< ?????????????????? ?????????????? ?? ???????? ???????????? �SELECT COUNT(

UserAgent

*) FROM random_entries[[DEBUG] ???????? ???????????? ????????????????????????????????. ?????????? ??????????????: ? �2024-? ��i�-? ��i� ? ��i�:? ��i�:? ��i��INSERT INTO random_entries (id, random_value, timestamp) VALUES (?1, ?2, ?3)[DEBUG] ???

[Configuration Offset]

0x005DD6EE

Malware Configuration - Vidar Config. Remote Dll Download #2
Config. Field
Value
C2

https://www.rust-lang.org/���0?]@��� �������??��,���0?]@��� �������??�����0?]@��� �������??��)���? �?:???:???:???:???:???:???:???:???:???:???:???:???:???:?? ;???:???:???:??���������������������������??&@���C:\Users\ilya\.cargo\registry\src\index.cra

Botnet

tes.io-1949cf8c6b5b557f\http-1.4.0\src\header\map.rs�??]@���_�������-�� ���??]@���_�������9�����??]@���_�������M��&�����������F�����������������������size overflows MAX_SIZE�??]@���_�������?��#���()�����������������������������0?�@���called `Res

UserAgent

ult::unwrap_err()` on an `Ok` value��??�@�����������������p?(@���called `Result::unwrap()` on an `Err` value����������������������������P?�@���P?�@���C:\Users\ilya\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.31.0\src\lib.rs���??]

[Configuration Offset]

0x005DDA1B

Malware Configuration - Vidar Config. Remote Dll Download #3
Config. Field
Value
C2

https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eofC:\Users\ilya\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.36\src\msgs\deframer\buffers.rs��??_@���n�������?������message buffer full�����??_@���n�������?

Botnet

���.���??_@���n�������?������??_@���n�������?������CLIENT_EARLY_TRAFFIC_SECRETCLIENT_HANDSHAKE_TRAFFIC_SECRETSERVER_HANDSHAKE_TRAFFIC_SECRETCLIENT_TRAFFIC_SECRET_0SERVER_TRAFFIC_SECRET_0EXPORTER_SECRETC:\Users\ilya\.cargo\registry\src\index.crates.io-1

UserAgent

949cf8c6b5b557f\rustls-0.23.36\src\tls13\key_schedule.rs�res binderc e trafficc hs traffics hs trafficc ap traffics ap trafficexp masterres masterderivedech accept confirmationhrr ech accept confirmationkeyivtraffic updfinishedresumptionexporterexporting t

[Configuration Offset]

0x005F8C59

Malware Configuration - Vidar Config. Remote Dll Download #4
Config. Field
Value
C2

https://curl.se/docs/http-cookies.html # This file was generated by libcurl! Edit at your own risk. �%s �WARNING: failed to save cookies in %s: %s���%d��async_thrdd_destroy, thread joined������async_thrdd_destroy, thread detached����starting new resolve,

Botnet

with previous not cleaned up������resolve thread started for of %s:%d�����resolve thread failed init: %d��async_thrdd_shutdown, thread joined�����resolve, wait for thread to finish��not ��������threaded: is_resolved(), already done, dns=%sfound������is_res

UserAgent

olved() result=%d, dns=%sfound����init threaded resolve of %s:%d��getaddrinfo() thread failed to start����:%u�*���Hostname in DNS cache was stale, zapped�Hostname in DNS cache does not have needed family, zapped�������Shuffling %i addresses��Store negative

[Configuration Offset]

0x006E539E

Malware Configuration - Vidar Config. Remote Dll Download #5
Config. Field
Value
C2

https://docs.rs/getrandom#nodejs-es-module-support��������������������������#@���internal_code�������������������������`@���descriptionunknown_code�����������������������?P'@���os_errorUnknown Error: ?� OS Error: ?��'�������&��������������2

Botnet

������-�������/�������!��������������-�����������������������1�������-�������0�������e�������??p@���?p@���D?p@���X?p@���??p@���??p@���??p@���?p@���$?p@�������������������Q?p@���??p@���??p@���??p@���5fatal runtime error: failed to initiate p

UserAgent

anic, error ? , aborting �fatal runtime error: Rust panics must be rethrown, aborting fatal runtime error: Rust cannot catch foreign exceptions, aborting fatal runtime error: thread local panicked on drop, aborting thread name may not contain interior null

[Configuration Offset]

0x00709C12

Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: rusttest.pdb

58f7750a1d90245d1099027d086a4464 (8.65 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙