MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 14

Intelligence 14 IOCs YARA 10 File information Comments

SHA256 hash:	523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1
SHA3-384 hash:	cb9b5058e5d4acb60265fd1ac688c260b49148ca8362880c471b1ba4c484b789aa00be1923eb9fc5694cda828b4da776
SHA1 hash:	cb6332410c4d37dd6ce9929cc93adaaeff19ab20
MD5 hash:	7ee46544312f9217a04c6ecae3c637b2
humanhash:	emma-lemon-early-april
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	310'272 bytes
First seen:	2024-03-01 17:27:24 UTC
Last seen:	2024-03-01 17:42:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	0af8560cfad62a70e1f6684099ea52da (1 x Vidar)
ssdeep	3072:kL6X++3PKOpTpbpav1zakS5Miid0IoPmDj5dzx1U1PB3/EyXW/Q5dTTkW0/V9:c6tPKOxpg9W5MKIoP2dk1PuyScTT90
TLSH	T1CA64AF1366A3BC61DD1E4A318D2EC6F8762FB8714D5967672A38BB6F09701B1C263F01
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	0010140a11040000 (1 x Vidar)
Reporter	Bitsight
Tags:	exe vidar

Bitsight

url: https://vk.com/doc329118071_675464212?hash=qzYYxeYsynldprhP3sUSB89kztZL4pEZqkdSnduwp30&dl=565D3vBArNWArZKWvs0xYcL88EqG2D5JMqTT4ryvwxo&api=1&no_preview=1#gt

Intelligence

File Origin

# of uploads :

# of downloads :

501

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Сreating synchronization primitives

Behavior that indicates a threat

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint packed

Link:

https://www.filescan.io/uploads/65e21025f73edfc47702820a/reports/e305c6f3-cb81-46c9-9582-b73d66b5c116/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Vidar

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4b923df7-3d20-4fe1-b444-e0f0ed5ad866

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1401622

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected AntiVM3

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2024-03-01 17:28:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ki565nl4dedw44lx46qbnovvf7zbvrpmxo5p2c4nyxenyw45ltaq._file

Verdict:

malicious

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:438c7562661d92141bb0adbe01c2fc5f stealer

Link:

https://tria.ge/reports/240301-v1zm3sah27/

Behaviour

Modifies system certificate store

Program crash

Detect Vidar Stealer

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199644883218
https://t.me/neoschats

Unpacked files

SH256 hash:

661877e3ac4efe39fa9a9240da1f4da085721311555680eb37c8cbbcef0b2623

MD5 hash:

837ed68c9a612efa64957b95d7dfee1c

SHA1 hash:

e8663e677034d71b60c07d494a3404968008c54c

Detections:

VidarStealer

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/5f20a992-8c12-44a3-92a0-ffa82db7a834/

Parent samples :

0e8fbee0bc9bf2582c73dbb5c0e58abdeaecb7689f51bf16e888604e329aae6c
a6f08a3f8e1a8c2bbc982aaa662992c1d7400443e474f622d682d38ed7148d6c
523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1

SH256 hash:

523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1

MD5 hash:

7ee46544312f9217a04c6ecae3c637b2

SHA1 hash:

cb6332410c4d37dd6ce9929cc93adaaeff19ab20

Link:

https://www.unpac.me/results/5f20a992-8c12-44a3-92a0-ffa82db7a834/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	Windows_Generic_Threat_c374cd85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe 523beeb57c19076e7177e7a016bab52ff21ac5ecbbbafd0b8dc5c8dc5b9d5cc1

(this sample)

Dropped by

Privateloader

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	GDI32.dll::StretchDIBits
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindNextVolumeMountPointA KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationW KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AddConsoleAliasW KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleA KERNEL32.dll::ReadConsoleW KERNEL32.dll::ReadConsoleInputA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryExW KERNEL32.dll::CreateFileA KERNEL32.dll::RemoveDirectoryW KERNEL32.dll::GetTempFileNameA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegSetValueA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample