MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments 1

SHA256 hash:	3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f
SHA3-384 hash:	3fb35fdd1b3edd22930b74790cdf312712118a48dcbc2edc38f624d54732584db44a3fc589ca522c68135dfc63201a8e
SHA1 hash:	0ccada395556cca7a0bd6790260a3246e713b76c
MD5 hash:	2405f52eca4630f5ed7d0a5577457520
humanhash:	butter-foxtrot-triple-oregon
File name:	2405f52eca4630f5ed7d0a5577457520
Download:	download sample
Signature	Vidar Create hunting rule
File size:	1'969'528 bytes
First seen:	2023-05-02 11:20:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:HI9ogyrryrCG6XpMa53pAQJEUDSP8na7nUAdaf6CDruxp6/j:6vHr2pME+NIZa7nJaSCDrCp6/j
Threatray	1'379 similar samples on MalwareBazaar
TLSH	T170955A2439EA501AF173EFB65FE479A6DA6FB7333B03646E1051038A0623A41DED153E
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	zbetcheckin
Tags:	85-217-144-143 exe signed vidar

Code Signing Certificate

Organisation:	gofile Ltd Inc
Issuer:	gofile Ltd Inc
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-05-02T08:22:19Z
Valid to:	2024-05-02T08:22:19Z
Serial number:	dd57faf38a4c80cbb81b5d542928707f
Thumbprint Algorithm:	SHA256
Thumbprint:	532e5ac0a5f5e9476e211ff8fdb4d699b288688e7349d420876cbff3513937a8
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

336

Origin country :

Vendor Threat Intelligence

Malware family:

vidar

ID:

File name:

2405f52eca4630f5ed7d0a5577457520

Verdict:

Malicious activity

Analysis date:

2023-05-02 11:21:40 UTC

Tags:

stealer vidar trojan arkei evasion

Link:

https://app.any.run/tasks/8d92c0c2-6667-425e-abb4-f4576d9dca5f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/386075/

Detection(s):

SecuriteInfo.com.Variant.Ser.MSILHeracles.1770.4494.1922.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a service

Loading a system driver

Sending a custom TCP request

Launching a process

Creating a file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Reading critical registry keys

Using the Windows Management Instrumentation requests

Enabling autorun for a service

Forced shutdown of a system process

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/6450f21f463eacbc57db6e91/reports/d44009bc-8796-4ab3-bb82-52262e0990d2/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/942ce710-fef2-4b57-b3a8-dd840b885f63

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1224592

Signature

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample is not signed and drops a device driver

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f/

Threat name:

Win64.Spyware.Vidar

Status:

Malicious

First seen:

2023-05-02 11:21:09 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

16 of 23 (69.57%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hx3dgyb2uifbpnpyopkwaam3l4m5cunddsyovhkwwkwz6avvxf7q._file

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:9cfd246b122e71a592dbea27a1739d45 persistence spyware stealer

Link:

https://tria.ge/reports/230502-nfzzsaag65/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Loads dropped DLL

Uses the VBS compiler for execution

Sets service image path in registry

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199501059503
https://t.me/mastersbots

Unpacked files

SH256 hash:

3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f

MD5 hash:

2405f52eca4630f5ed7d0a5577457520

SHA1 hash:

0ccada395556cca7a0bd6790260a3246e713b76c

Link:

https://www.unpac.me/results/26fcf5fc-ed26-40a0-a741-bfde35e8ffd4/

Malware family:

Vidar.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3df633603aa2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe 3df633603aa20a17b5f873d560019b5f19d151a31cb0ea9d56b2ad9f02b5b97f

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2622096/

Cape

https://www.capesandbox.com/analysis/386075/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-05-02 11:20:35 UTC

url : hxxp://85.217.144.143/files/HDCR.exe