MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77
SHA3-384 hash: 32d9da87286c1f27fbb86df180bdc2c39c90bb57312c565041a128ebb879d287ad9871fa8d7b63cc745186eadb9b3776
SHA1 hash: 77e1ff23dca562b9d1c5b9174c5d4839c100ced1
MD5 hash: 4ad2cc8139fdffd857f9e8d841d96aff
humanhash: stairway-blue-three-berlin
File name:SecuriteInfo.com.Trojan.MSIL.Crypt.23032.28073
Download: download sample
Signature Vidar
Create hunting rule
File size:15'022'592 bytes
First seen:2023-06-30 16:55:49 UTC
Last seen:2023-06-30 17:48:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'449 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 196608:rkywMIVyOXLGkR4s7ub/4Jsx03geggcufB1cfNJAsHW7wrytFGTRm00Z409G0:pwM2NLGksQJsHxZupGAEqE6R9G
Threatray 7 similar samples on MalwareBazaar
TLSH T10EE6F013B7878FB1C7491B37CD9F15246BA8CEE13713D71A6ACA136A58C37AA894410F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe vidar

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
arkei
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Trojan.MSIL.Crypt.23032.28073
Verdict:
Malicious activity
Analysis date:
2023-06-30 17:47:14 UTC
Tags:
stealer arkei vidar
Link:
https://app.any.run/tasks/40936530-ecf3-4e87-a362-9ed7d9179451

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Crypt.23032.28073.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Using the Windows Management Instrumentation requests
Creating a window
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/649f0932204315fbc16bda4a/reports/77f3be15-5388-4b2b-8c61-9ff7eb946fa0/overview
Verdict:
Malicious
Labled as:
MSIL/GenKryptik_AGeneric.ABH trojan
Link:
https://www.hybrid-analysis.com/sample/143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6e3ef52c-abcf-4397-8ca5-fa6a5cf7abd6
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1264354
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected Costura Assembly Loader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77/
Threat name:
Win32.Spyware.Vidar
Create hunting rule
Status:
Suspicious
First seen:
2023-06-28 22:59:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cq6tmtovaz2cnd6l6iwcsfburous63y6ykbcwq5ttjn2b3jrnv3q._file
Verdict:
malicious
Similar samples:
2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd
Vidar
25e0f6235b109679e8f74f142eb8807c825d33070c7161c86b9600650559247e
Vidar
5d0c01b1ceef88fb8963383443d7b833df48e10f8708edbfadb457c4ca99ffb4
Vidar
94ecbf6f04ad4476d6b032a83b96f93897af0e16821b76802aaafb11677ad836
Vidar
d7e4265853d2a220b4d89c06d529664436bf2d3aab76cd19bb3733771289fbad
Vidar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:e42599537c56c3ab94348265bcc4fa21 discovery spyware stealer
Link:
https://tria.ge/reports/230630-vfrfzafa4x/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Vidar
Malware Config
C2 Extraction:
https://steamcommunity.com/profiles/76561199520592470
https://t.me/motafan
Unpacked files
SH256 hash:
8cae1513099ba1094ca0dc9e4b0663737702eb55926664aa26348c46929fe30f
MD5 hash:
7686421ab6ed5fe443527d7940e78a12
SHA1 hash:
e7c9b5a947508be2bb1569a1000a46bc9fdc0288
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
b207d230e4b63dba0a34d800407d89585a062c02c5c31286aa295f69043350c2
MD5 hash:
fc1ba0544b94b6e6f1188ac272048973
SHA1 hash:
dc2676ed2814ee4f1c353e9e9661f5db6f6c4330
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
96d3a67c455b22a9b9ed92c9d7224d10f16612240bc6d9e3e89e8e76247285a3
MD5 hash:
c2f5eaed3c5c6a19973c9881f73e05e0
SHA1 hash:
b3aaa6afd2c7556c9e35ca706640e23b7b255953
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
c169bcb020de1589ecd3b09c831d5d1f216edab4dc6bd789c2105fa91d6829e8
MD5 hash:
12139e6fd85b78631b23537fcf096c25
SHA1 hash:
4f552d464eb1c241ce24552b4d6ed1b92965c1b8
Detections:
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
a26c0c5b9769a3a2901e3cc8753f5d76e24fd9ef7ef9609f8dc229ff1a533ff9
MD5 hash:
4fb034fd1afc85ef846f05772a007657
SHA1 hash:
1d17205a2fe13d54d1f1be078847f01330b9c3a0
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
8cae1513099ba1094ca0dc9e4b0663737702eb55926664aa26348c46929fe30f
MD5 hash:
7686421ab6ed5fe443527d7940e78a12
SHA1 hash:
e7c9b5a947508be2bb1569a1000a46bc9fdc0288
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
b207d230e4b63dba0a34d800407d89585a062c02c5c31286aa295f69043350c2
MD5 hash:
fc1ba0544b94b6e6f1188ac272048973
SHA1 hash:
dc2676ed2814ee4f1c353e9e9661f5db6f6c4330
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
96d3a67c455b22a9b9ed92c9d7224d10f16612240bc6d9e3e89e8e76247285a3
MD5 hash:
c2f5eaed3c5c6a19973c9881f73e05e0
SHA1 hash:
b3aaa6afd2c7556c9e35ca706640e23b7b255953
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
c169bcb020de1589ecd3b09c831d5d1f216edab4dc6bd789c2105fa91d6829e8
MD5 hash:
12139e6fd85b78631b23537fcf096c25
SHA1 hash:
4f552d464eb1c241ce24552b4d6ed1b92965c1b8
Detections:
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
a26c0c5b9769a3a2901e3cc8753f5d76e24fd9ef7ef9609f8dc229ff1a533ff9
MD5 hash:
4fb034fd1afc85ef846f05772a007657
SHA1 hash:
1d17205a2fe13d54d1f1be078847f01330b9c3a0
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
8cae1513099ba1094ca0dc9e4b0663737702eb55926664aa26348c46929fe30f
MD5 hash:
7686421ab6ed5fe443527d7940e78a12
SHA1 hash:
e7c9b5a947508be2bb1569a1000a46bc9fdc0288
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
b207d230e4b63dba0a34d800407d89585a062c02c5c31286aa295f69043350c2
MD5 hash:
fc1ba0544b94b6e6f1188ac272048973
SHA1 hash:
dc2676ed2814ee4f1c353e9e9661f5db6f6c4330
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
96d3a67c455b22a9b9ed92c9d7224d10f16612240bc6d9e3e89e8e76247285a3
MD5 hash:
c2f5eaed3c5c6a19973c9881f73e05e0
SHA1 hash:
b3aaa6afd2c7556c9e35ca706640e23b7b255953
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
c169bcb020de1589ecd3b09c831d5d1f216edab4dc6bd789c2105fa91d6829e8
MD5 hash:
12139e6fd85b78631b23537fcf096c25
SHA1 hash:
4f552d464eb1c241ce24552b4d6ed1b92965c1b8
Detections:
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
a26c0c5b9769a3a2901e3cc8753f5d76e24fd9ef7ef9609f8dc229ff1a533ff9
MD5 hash:
4fb034fd1afc85ef846f05772a007657
SHA1 hash:
1d17205a2fe13d54d1f1be078847f01330b9c3a0
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
8cae1513099ba1094ca0dc9e4b0663737702eb55926664aa26348c46929fe30f
MD5 hash:
7686421ab6ed5fe443527d7940e78a12
SHA1 hash:
e7c9b5a947508be2bb1569a1000a46bc9fdc0288
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
b207d230e4b63dba0a34d800407d89585a062c02c5c31286aa295f69043350c2
MD5 hash:
fc1ba0544b94b6e6f1188ac272048973
SHA1 hash:
dc2676ed2814ee4f1c353e9e9661f5db6f6c4330
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
96d3a67c455b22a9b9ed92c9d7224d10f16612240bc6d9e3e89e8e76247285a3
MD5 hash:
c2f5eaed3c5c6a19973c9881f73e05e0
SHA1 hash:
b3aaa6afd2c7556c9e35ca706640e23b7b255953
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
c169bcb020de1589ecd3b09c831d5d1f216edab4dc6bd789c2105fa91d6829e8
MD5 hash:
12139e6fd85b78631b23537fcf096c25
SHA1 hash:
4f552d464eb1c241ce24552b4d6ed1b92965c1b8
Detections:
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
a26c0c5b9769a3a2901e3cc8753f5d76e24fd9ef7ef9609f8dc229ff1a533ff9
MD5 hash:
4fb034fd1afc85ef846f05772a007657
SHA1 hash:
1d17205a2fe13d54d1f1be078847f01330b9c3a0
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
8cae1513099ba1094ca0dc9e4b0663737702eb55926664aa26348c46929fe30f
MD5 hash:
7686421ab6ed5fe443527d7940e78a12
SHA1 hash:
e7c9b5a947508be2bb1569a1000a46bc9fdc0288
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
b207d230e4b63dba0a34d800407d89585a062c02c5c31286aa295f69043350c2
MD5 hash:
fc1ba0544b94b6e6f1188ac272048973
SHA1 hash:
dc2676ed2814ee4f1c353e9e9661f5db6f6c4330
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
96d3a67c455b22a9b9ed92c9d7224d10f16612240bc6d9e3e89e8e76247285a3
MD5 hash:
c2f5eaed3c5c6a19973c9881f73e05e0
SHA1 hash:
b3aaa6afd2c7556c9e35ca706640e23b7b255953
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
c169bcb020de1589ecd3b09c831d5d1f216edab4dc6bd789c2105fa91d6829e8
MD5 hash:
12139e6fd85b78631b23537fcf096c25
SHA1 hash:
4f552d464eb1c241ce24552b4d6ed1b92965c1b8
Detections:
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
a26c0c5b9769a3a2901e3cc8753f5d76e24fd9ef7ef9609f8dc229ff1a533ff9
MD5 hash:
4fb034fd1afc85ef846f05772a007657
SHA1 hash:
1d17205a2fe13d54d1f1be078847f01330b9c3a0
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
SH256 hash:
143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77
MD5 hash:
4ad2cc8139fdffd857f9e8d841d96aff
SHA1 hash:
77e1ff23dca562b9d1c5b9174c5d4839c100ced1
Link:
https://www.unpac.me/results/d2e8730a-9330-4c3c-bad0-9ff28b3d8340/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments