MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 18 File information Comments

SHA256 hash:	3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b
SHA3-384 hash:	6181adac79906cce315ccd25e25267a8b76f03b8ef884229701e3f3c03db6ad3b820f383b325d2d20dff23bead023eaa
SHA1 hash:	5a51c5aa0cc796d0d5d6c530dc99f0fb81d37a7a
MD5 hash:	5f6e3dda73b232eaa8792f5880b6a90c
humanhash:	speaker-sink-magazine-jersey
File name:	5f6e3dda73b232eaa8792f5880b6a90c.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	339'456 bytes
First seen:	2024-03-27 06:48:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	72e186f4643d828245a9b4274ecaa3d8 (2 x Vidar, 1 x GCleaner, 1 x Smoke Loader)
ssdeep	3072:+lMaCCfSxZQTu+lliXOOS5rO3LBCZcJOIgB/50+IaUnoHyKnD7oTk6pfApTxe+FG:+lpM9HORot4wO5/K+owyKnDTEOT0+FG
TLSH	T16A74AE0372D1BC60E56287B29D2DC6E4223EFD728E686B6B33587F1F34B11A1D562B41
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	020605030b583000 (1 x Vidar)
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

314

Origin country :

Vendor Threat Intelligence

Malware family:

vidar

ID:

File name:

3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b.exe

Verdict:

Malicious activity

Analysis date:

2024-03-27 06:53:46 UTC

Tags:

vidar

Link:

https://app.any.run/tasks/2d73563d-ad10-4c1d-9ad7-ba9255b6b52e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Behavior that indicates a threat

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Launching the default Windows debugger (dwwin.exe)

Launching a process

Moving a file to the Program Files subdirectory

Replacing files

Forced system process termination

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/6603c1615ae25e8d7244945b/reports/8f7b4469-37a3-4670-9f47-a039b5d5b61c/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Vidar

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3404d72e-3151-4ca5-a8e4-c8b0e63cbe81

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1416228

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Country aware sample found (crashes after keyboard check)

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected AntiVM3

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2024-03-26 21:24:59 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gi3elfsvxih6mvvagfp7ad3byh4pqu5oom2hvp4lztddbiceo5fq._file

Verdict:

malicious

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:22d12fb91f01647fe2107fec81f0cc22 stealer

Link:

https://tria.ge/reports/240327-hlchsahg6z/

Behaviour

Modifies system certificate store

Program crash

Detect Vidar Stealer

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok

Unpacked files

SH256 hash:

9d7eb4df8edb91a66a8a876c71556414d5fba89803c6f7b60ea52e158cc67815

MD5 hash:

1ce729d1c5c72d0962d040d5f649f7c3

SHA1 hash:

b280bd307209f915cc6dbea23e9c13b2c8d02589

Detections:

VidarStealer

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/5d4f4053-895f-41da-97b0-9accf05d12c0/

Parent samples :

00ea585591b87304ac152936bbd2ab9b9c68583a76c5c3cc5da5646dd6614f96
3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b
eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58
b30369cdc0a8cda16ba0703777a423f601885ce02ec151349892b56d0e769fe7
f78ea486369251e0879a5189503f607ba3168081171f6f7ee848b38009a24439

SH256 hash:

3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b

MD5 hash:

5f6e3dda73b232eaa8792f5880b6a90c

SHA1 hash:

5a51c5aa0cc796d0d5d6c530dc99f0fb81d37a7a

Link:

https://www.unpac.me/results/5d4f4053-895f-41da-97b0-9accf05d12c0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	EXE_Stealer_StealC_Feb2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	Windows_Generic_Threat_c374cd85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Generic_2993e5a5 Create hunting rule
Author:	Elastic Security

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe 3236459655ba0fe656a0315ff00f61c1f8f853ae73347abf8bccc630a044774b

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2793216/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindFirstVolumeMountPointW KERNEL32.dll::GetFirmwareEnvironmentVariableW KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::PeekConsoleInputW KERNEL32.dll::ReadConsoleA KERNEL32.dll::SetConsoleTextAttribute KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryA KERNEL32.dll::RemoveDirectoryA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::QueryDosDeviceA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample