MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 15


Intelligence 15 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c
SHA3-384 hash: b022a32c9cb8f3bd6de3ec4e1680a6a20c09d854728803b4410a49e29a2b1eb74d3b9db23c7cee0440d793e23b0153b6
SHA1 hash: 9d2e4875e509dccf60705a5baf666c4c4a7616d7
MD5 hash: 77badd4fd610c2abc079680ca6661f18
humanhash: gee-cat-sad-ceiling
File name:file
Download: download sample
Signature Vidar
Create hunting rule
File size:216'064 bytes
First seen:2024-02-29 17:21:40 UTC
Last seen:2024-02-29 19:30:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3409878def83bdb246ddfafca1d1bf27 (2 x Vidar, 1 x Glupteba)
ssdeep 3072:u8i3u+X+RbpTL/iD37WiZ9pi6Ry9x+5fLUn7TzDPaVYoE:w3u+uRlTrc75i6Ryf+BLUnPzb
TLSH T1D424BE2136E1D037E5B7273058B4C6B1363AB8722B7181BB76A4673E1E613D04A7877E
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 64d29a9891a9b989 (1 x Vidar)
Reporter Bitsight
Tags:exe vidar


Avatar
Bitsight
url: https://vk.com/doc329118071_675427851?hash=7bcihwMsGTJZZczOc1kOrBwydZGgafZvzYFhaKOdWsz&dl=xkvA8Ijhsx4HgONFuXtvvpZcWzJ345B541r0E9bFzdk&api=1&no_preview=1#gt

Intelligence

File Origin
# of uploads :
3
# of downloads :
612
Origin country :
US US
Vendor Threat Intelligence
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
4363463463464363463463463.exe
Verdict:
Malicious activity
Analysis date:
2024-02-29 19:01:13 UTC
Tags:
hausbomber phorpiex trojan loader stealer rat njrat bladabindi remote opendir ramnit vidar gcleaner evasion raccoon recordbreaker risepro stealc lokibot
Link:
https://app.any.run/tasks/94a14b0f-b9a7-4d42-9a17-86a6647c7623

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.14456.18578.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint packed
Link:
https://www.filescan.io/uploads/65e0bd3ef73edfc477010055/reports/8df7417b-455c-4d84-9fb2-fa474510f1b8/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f11cd280-bcf2-45d1-8b7f-d5772a97b11b
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1401051
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Country aware sample found (crashes after keyboard check)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-02-29 17:22:06 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2h35yf4tpzfqldt3o24bzmkxxvozn3it5i36fxirbqe4mu2vzwa._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:438c7562661d92141bb0adbe01c2fc5f stealer
Link:
https://tria.ge/reports/240229-vxjsfsgb36/
Behaviour
Modifies system certificate store
Program crash
Detect Vidar Stealer
Vidar
Malware Config
C2 Extraction:
https://steamcommunity.com/profiles/76561199644883218
https://t.me/neoschats
Unpacked files
SH256 hash:
661877e3ac4efe39fa9a9240da1f4da085721311555680eb37c8cbbcef0b2623
MD5 hash:
837ed68c9a612efa64957b95d7dfee1c
SHA1 hash:
e8663e677034d71b60c07d494a3404968008c54c
Detections:
VidarStealer
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Link:
https://www.unpac.me/results/556989e4-b162-4495-8370-58f2871eb51c/
Parent samples :
0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c
a6f08a3f8e1a8c2bbc982aaa662992c1d7400443e474f622d682d38ed7148d6c
523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1
SH256 hash:
0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c
MD5 hash:
77badd4fd610c2abc079680ca6661f18
SHA1 hash:
9d2e4875e509dccf60705a5baf666c4c4a7616d7
Link:
https://www.unpac.me/results/556989e4-b162-4495-8370-58f2871eb51c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Windows_Generic_Threat_c374cd85
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2771729/

Comments