MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228
SHA3-384 hash: 1f8a8e8a54e65235447946f25eb1239580e14f181a6e651a5216ebf2fca0bca726d6491523c6b3c241bfa2d9d99dd2d9
SHA1 hash: 969dd4ab6006f0470fab17b2803912082fa49283
MD5 hash: dc9e7af38966a331ed872c56bcb5bd79
humanhash: glucose-orange-mountain-august
File name:file
Download: download sample
Signature Vidar
Create hunting rule
File size:923'648 bytes
First seen:2023-05-19 10:28:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:DtZzl//mVsahD3lmgMD8j2EhYf4Fp7pb6zY:5ZzBahD3M98j2EMOp
Threatray 203 similar samples on MalwareBazaar
TLSH T1C915A43D0AA58AEFC0BBD364A7CC4997FA739817F15C9BA944C6035272436CE60C61DE
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe vidar


Avatar
andretavare5
Sample downloaded from https://vk.com/doc797927207_660611341?hash=KSSXtIcWQ7Utyj8jpAlmJ387kHYCZGpOtziOTncLCHg&dl=G44TOOJSG4ZDANY:1684435703:drY8XJQt1SpsqXVv7tWT5b2ezJzB67GKyA0wk6s4xIo&api=1&no_preview=1#b1

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
US US
Vendor Threat Intelligence
Malware family:
arkei
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-05-19 10:30:49 UTC
Tags:
stealer arkei vidar
Link:
https://app.any.run/tasks/d7457b27-7b71-4c9d-8573-53973a99845c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILMamut.10655.24482.31254.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/64674f6f4a9e063828bee8fa/reports/d7287225-3d82-4a94-a435-fbed7e893921/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILMamut
Link:
https://www.hybrid-analysis.com/sample/19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/23a25019-561d-47ab-a2a1-b86cc101c9d1
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1237067
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228/
Threat name:
ByteCode-MSIL.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-05-17 00:48:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dgtpf6xffzmxc4jdumum6qzrygczy225na4mwihjsyuab27loiua._file
Verdict:
malicious
Similar samples:
0b51b2819a128abdfab0006900667b5e05329aa0416445c43db76e2f503b92ff
Vidar
1e42d63ed11929379e5739414c944bc755fb2e212eb475777de4a7e0ef54c517
Vidar
2068c94f118c1921f4333d97935e35ce175803820c44444277563fe0f82398fb
Vidar
311ad9668bfcc6cf1688a6ccd995fffc2f6c7891df6e3b3e0a528488049b8f0c
Vidar
331952066aee8437403773b213a4b7ebee56e905929e86432c4a7623f05ac79a
Vidar
4311ebed531b92938b18b79d3982cfe8d48c5d395113ebc13aa25f4f29f1e211
Vidar
afd33d4aa80a47b1cf9bb0ea15ba7cedee6dbd453aca2c7bce5fa59d04143363
Vidar
ee5e1cf8922e2c866beb155a2227d47e98bf31e35507ee135a7c8b1f9a3413ba
Vidar
f54a2c74fd7fc447eae84474498021e4030540c7dbc03f95dab24b63fbb6eee2
Vidar
fee5e202497ecf3e0f2d829f11afe55c8c7f525cd08bf1d570a96e226bb0bdca
Vidar
+ 193 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:23024979f5954ed7b86ed774172eb62e discovery spyware stealer
Link:
https://tria.ge/reports/230519-mh8h9sdc77/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Vidar
Malware Config
C2 Extraction:
https://steamcommunity.com/profiles/76561199263069598
https://t.me/cybehost
Unpacked files
SH256 hash:
b1b74e4731c989120f400703028152b4105298d43fdd6e078e3cc6721757223d
MD5 hash:
edf093f74714ba0b834d2b791dd89b67
SHA1 hash:
d770999ca70b27ff0dc5ffd0440baf915f620e0c
Link:
https://www.unpac.me/results/27e2568a-b58e-4ce6-bd80-39bff5b528ca/
SH256 hash:
a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209
MD5 hash:
e7709a907be0cdb6ff7eb99daee97c6c
SHA1 hash:
bb3f6871c40f54070b53947bf6958d410ea8bac1
Link:
https://www.unpac.me/results/27e2568a-b58e-4ce6-bd80-39bff5b528ca/
SH256 hash:
b3fd314e730f1a7e79755ba50ed0f808068b229d2d6a9b6de3c4db6fc44af3f3
MD5 hash:
505f1bfe00748a7ff6085bccfc4c47fe
SHA1 hash:
88ff8e2df8e36bb4fa2aa03c66bb98539d58cfdb
Detections:
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/27e2568a-b58e-4ce6-bd80-39bff5b528ca/
SH256 hash:
19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228
MD5 hash:
dc9e7af38966a331ed872c56bcb5bd79
SHA1 hash:
969dd4ab6006f0470fab17b2803912082fa49283
Link:
https://www.unpac.me/results/27e2568a-b58e-4ce6-bd80-39bff5b528ca/
Malware family:
Vidar.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/19a6f2fae52e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.71
Link:
https://yomi.yoroi.company/submissions/19a6f2fae52e59717123a328cf4331c1859c6b5d6838cb20e9962800ebeb7228

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Dotnet_Hidden_Executables_Detect
Create hunting rule
Author:Mehmet Ali Kerimoglu (@CYB3RMX)
Description:This rule detects hidden PE file presence.
Reference:https://github.com/CYB3RMX/Qu1cksc0pe
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by

Comments