MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments 1

SHA256 hash:	026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd
SHA3-384 hash:	f60ac48576f6c02297cc1bb4ef0a3ae2af2fe755acf66d411bed6d5b01b6851f705dcbd2a2f6f8a9ca09adb8be030239
SHA1 hash:	c2d3ad4d1f5ec85453b4d9f92f660c4ec23779fc
MD5 hash:	6bb59137fb112f7970ffeca6f23365cc
humanhash:	virginia-mirror-massachusetts-georgia
File name:	6bb59137fb112f7970ffeca6f23365cc
Download:	download sample
Signature	Vidar Create hunting rule
File size:	237'568 bytes
First seen:	2024-02-28 13:48:25 UTC
Last seen:	2024-02-28 15:52:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fa9d771b11e0f02db434815b765f591e (3 x Vidar, 1 x GCleaner)
ssdeep	3072:sw7Q4Q0Xvbjsw9Nw6DNnsVid0HaaLnLHTfSKwqrYSKLoEZ4L4CM5e81:sUHQATAwVNWidUbAqzKLtwM5eq
TLSH	T19E34F1217BD0D832C09A223448B8D6F19E3ABC61D671408BF3D47B3E2FB6AD15678756
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	64d29a9889b9b999 (1 x Vidar, 1 x CoinMiner)
Reporter	zbetcheckin
Tags:	32 exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

330

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/478131/

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.17547.24083.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint packed

Link:

https://www.filescan.io/uploads/65df3ac253c8f1aac4585c83/reports/9fa6e032-7e00-400e-9c77-247964824df9/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Vidar

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e1d57af3-be28-4bbc-bb50-9dcf20aa950b

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1400213

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Country aware sample found (crashes after keyboard check)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2024-02-28 13:49:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ajrbpshz6dayog3gxq7s6sbte24zka3l6xgcdwugei6rmsipe66q._file

Verdict:

malicious

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:522fef6d5a166879865036137c81cdeb stealer

Link:

https://tria.ge/reports/240228-q4nyjada88/

Behaviour

Modifies system certificate store

Program crash

Detect Vidar Stealer

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199644883218
https://t.me/neoschats

Unpacked files

SH256 hash:

7c14cce6b9370a9fb5270b4ac2b31e53273fdcd11bb8be304be6662790945191

MD5 hash:

2e7882ce04f88607cca02a654dd1937a

SHA1 hash:

40820eacab66aba90ee4cf9a2ec66e6771992e26

Detections:

VidarStealer

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/329deb39-4d01-44d2-8154-41fd36a0dca1/

SH256 hash:

026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd

MD5 hash:

6bb59137fb112f7970ffeca6f23365cc

SHA1 hash:

c2d3ad4d1f5ec85453b4d9f92f660c4ec23779fc

Link:

https://www.unpac.me/results/329deb39-4d01-44d2-8154-41fd36a0dca1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.