MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 11


Intelligence 11 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea
SHA3-384 hash: da6e71e20bab07ba6bf737324ae53a7f6c7ca0e4d680a42e20caf5b6a4fbced59b4ed7497343b037bdeea955bffb66a1
SHA1 hash: d4e24a72ffb034b98863b1914b314f6027523008
MD5 hash: 90a42d83c1b6d034e07d4df4f95e9dd0
humanhash: lake-bluebird-coffee-tango
File name:Bootstrapper.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:7'860'912 bytes
First seen:2024-07-25 06:03:54 UTC
Last seen:2024-07-25 06:25:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 52ca58ae6bfb6789c7cd30418c624e24 (1 x Vidar)
ssdeep 196608:QxeIwTF7OcxdloXameSfIh7OYi3g3PoibyMtaI6HMaJTtGbJOm:C6F7Ool+eSfIhq+oibyM+m
TLSH T1B6866B22E7D6C076EDB21730ED3E765684BABE731971811F22843A1D0D73982E9357A3
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f0c4868c8ca2f8f0 (2 x RustyStealer, 1 x CobaltStrike, 1 x Vidar)
Reporter JAMESWT_WT
Tags:exe vidar

Intelligence

File Origin
# of uploads :
2
# of downloads :
356
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.25913.9963.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a34cb181e42e2b16c7959a
Tags:
Banker Encryption Execution Generic Infostealer Network Other Static Stealth Vidar
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Connecting to a non-recommended domain
Sending an HTTP POST request
Running batch commands
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm crypto epmicrosoft_visual_cc expand explorer fingerprint lolbin microsoft_visual_cc overlay packed remote rundll32
Link:
https://www.filescan.io/uploads/66a1ead4dfa8b2fced4e5928/reports/c6fc8901-7887-4594-90f9-511f0d315259/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Hancitor, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1481401
Behaviour
Behavior Graph:
n/a
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-07-24 18:16:07 UTC
File Type:
PE (Exe)
Extracted files:
57
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d263264uu5sepg7agy6weddmnmvudnnvlcemsvdlelifba23elva._file
Verdict:
unknown
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar credential_access discovery spyware stealer
Link:
https://tria.ge/reports/240725-gsk8tssejr/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Credentials from Password Stores: Credentials from Web Browsers
Detect Vidar Stealer
Vidar
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a8c5f47c-868d-489d-a524-b083690efb29
Unpacked files
SH256 hash:
1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea
MD5 hash:
90a42d83c1b6d034e07d4df4f95e9dd0
SHA1 hash:
d4e24a72ffb034b98863b1914b314f6027523008
Link:
https://www.unpac.me/results/72a912ea-8acb-4d05-8506-9ebe1c274518/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1ebdbd7b94a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/malwrhunterteam/status/1816187657086722260

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertSidToStringSidA
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll::CopySid
ADVAPI32.dll::CreateWellKnownSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdipDeleteGraphics
gdiplus.dll::GdipFillRectangleI
gdiplus.dll::GdipDeleteBrush
gdiplus.dll::GdipAlloc
gdiplus.dll::GdipCreateFromHDC
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAccessAllowedAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::GetSecurityDescriptorDacl
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::SetSecurityDescriptorDacl
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenThreadToken
KERNEL32.dll::SetProcessMitigationPolicy
KERNEL32.dll::OpenSemaphoreA
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextW
ADVAPI32.dll::CryptCreateHash
ADVAPI32.dll::CryptGetHashParam
ADVAPI32.dll::CryptHashData
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegGetValueW
ADVAPI32.dll::RegGetValueA
ADVAPI32.dll::RegNotifyChangeKeyValue
ADVAPI32.dll::RegOpenKeyExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfigW
ADVAPI32.dll::ControlService
ADVAPI32.dll::EnumDependentServicesW
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::QueryServiceConfigW

Comments