MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a
SHA3-384 hash:	e76b3681d90830d0d63a1571585ddf5e1136ea80b41f65f16393a1eb6c9fea0a4841412230524f33f36addbc472d5411
SHA1 hash:	3bfb0d466e775cfded08be0bbde7329b642324e5
MD5 hash:	6a68babd027c9fee09fbc161259f04db
humanhash:	jig-snake-wyoming-thirteen
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	340'480 bytes
First seen:	2023-11-30 13:46:21 UTC
Last seen:	2023-11-30 22:05:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	06bae1c7ddd817ff4dd7b5b0ee20a098 (2 x Smoke Loader, 1 x Vidar, 1 x Stealc)
ssdeep	3072:uxlrrTgrrHy+ioC/cuUnqJtT/ai1VyHe55wPtjSPf5lOMY7M59UXgw8:SrTa28QKstTSi1IHe3ktePOhg5C0
TLSH	T12474299382F17D45E9268B729F1FE6FCB71EF2528E89776912189E1F00B1172C2A3750
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	00009042a4b08540 (1 x Vidar)
Reporter	andretavare5
Tags:	exe vidar

andretavare5

Sample downloaded from http://gons34cl.top/build.exe

Intelligence

File Origin

# of uploads :

# of downloads :

322

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

https://gons28cl.top/build.exe

Verdict:

Malicious activity

Analysis date:

2023-11-30 11:49:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/baf4a470-e6a9-48e7-b630-773f7327a05e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/461410/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Gathering data

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f81c1abd-a507-4d2e-af68-ba88d2f606b8

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1350539

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected AntiVM3

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2023-11-30 12:57:28 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 23 (91.30%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=goyevdl3ylne2xqaz2nm2dsxkxnpsyprvblu56clupkyoyispvva._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/231130-q3h1wsce56/

Behaviour

Modifies system certificate store

Unpacked files

SH256 hash:

5f85c8778e69cf9c8ad5e7865dc66dcf25cbfe385e2f2227886ca2b7ae845dba

MD5 hash:

12317311ec592c884bc6eddca1cc5954

SHA1 hash:

a121f456d33959944593f7fed9ac14725855a576

Detections:

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/f907e8e6-6dcc-40ee-aff1-e773e0ff8af5/

Parent samples :

1b23847db328a1eb04e93c74451d481cbbaa4d7110fe87440b203a9dad36199a
8a59a0e9b326966e4fb7353078bf82b765df754e575a3bfe3bb44220ffb41116
465bec204932baa110e7344f725d7a9acd5c1a599927e6a3a080aa31dc18101f
8c5858fdc6044de48a8f22b1ae51eb6bfa45befe91c3a854b2b0a99b79d41581
199c44e7bc7c65d6be9959d2d5875e9755104275de462698cd4f6ad94e57d25e
33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a

SH256 hash:

33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a

MD5 hash:

6a68babd027c9fee09fbc161259f04db

SHA1 hash:

3bfb0d466e775cfded08be0bbde7329b642324e5

Link:

https://www.unpac.me/results/f907e8e6-6dcc-40ee-aff1-e773e0ff8af5/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/33b04a8d7bc2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/33b04a8d7bc2da4d5e00ce9acd0e5755daf961f1a8574ef84ba3d58761127d6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.