MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 12

Intelligence 12 IOCs YARA 6 File information Comments 1

SHA256 hash:	050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14
SHA3-384 hash:	7a5b8b437f4666a34c05ebdbbb881f4183e6690e1db8add1db545902b0680ed4bca525caf5bae241cb7583f87b56cc5a
SHA1 hash:	020067b54db5b66c35461dfa1324427303850cb1
MD5 hash:	58792f0c0962965195d6036c6112f897
humanhash:	fruit-washington-nebraska-illinois
File name:	58792f0c0962965195d6036c6112f897
Download:	download sample
Signature	Vidar Create hunting rule
File size:	289'792 bytes
First seen:	2023-11-23 08:09:29 UTC
Last seen:	2023-11-23 09:24:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	37a2e081016677c458593140198e6db3 (2 x Vidar)
ssdeep	3072:BHslPEcQAUbhb3ADTF4oDeu3qxDzt9c1llEONAzKkG31jMQS6gVUTL/mYY/yHShI:tdZDbhrA32ue9xvIllEAz3WQsVe/iV0
Threatray	11 similar samples on MalwareBazaar
TLSH	T120546C1353F16C61E5274633AE2AC6F4771EB9708F196BAB33196E2F09701A2C663317
TrID	45.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.4% (.EXE) Win64 Executable (generic) (10523/12/4) 9.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.6% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	01030d0b09150701 (1 x Vidar)
Reporter	zbetcheckin
Tags:	32 exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

361

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/459828/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.30321.17164.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a file

Reading critical registry keys

Sending an HTTP GET request

Creating a window

Running batch commands

Stealing user critical data

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/655f08dc63589eb98c92f6f8/reports/e9f554e4-5972-4637-ade8-128d98b50ab7/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/08144495-d3b0-49d0-8bde-dcf11e83697e

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1346801

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2023-11-23 08:10:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 23 (65.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=auezo6ktnckr2m63ckitzjlcmgkpblq25qlslgmfldlzkwo3nmka._file

Verdict:

malicious

Vidar

050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14

Vidar

0ce7e14f4f6edb88963dd174c58772783d641a100834f89fe81802c515b0bbec

Vidar

7ee5c994ac006822269f3fe52d67cee97f5f80850451691a0bb721dc70169bae

Vidar

d883478d7646dd5f53a6ce22e76b432cf1023fb456d2fe8c90176b96754db9e9

Vidar

f5ca82a3a112ef4040a39165c3784d5350a9b3276f4378163501e575a1b30b0a

Vidar

+ 1 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/231123-j2pcyshd9y/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks installed software on the system

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Downloads MZ/PE file

Unpacked files

SH256 hash:

8f8b7e9fbab5bbe0040d21b7eb440eee852994b2a51392add6306546bb7b8f8a

MD5 hash:

013c93124981cb53dce8047c696983f3

SHA1 hash:

b711d73b688303a075fc996de67de5d63ae7d2ee

Link:

https://www.unpac.me/results/828d580e-6c1d-417d-9951-3bfadd4d44c4/

SH256 hash:

050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14

MD5 hash:

58792f0c0962965195d6036c6112f897

SHA1 hash:

020067b54db5b66c35461dfa1324427303850cb1

Link:

https://www.unpac.me/results/828d580e-6c1d-417d-9951-3bfadd4d44c4/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/050997795368/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe 050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/459828/

URLhaus

https://urlhaus.abuse.ch/url/2733777/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-11-23 08:09:30 UTC

url : hxxps://gobo25cl.top/build.exe