MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160
SHA3-384 hash: bcce38e960f76c8e069d94ddc111d8e48e635984e40e318a43578c78afa1f77524adac354ef4409e6bb24c98e0baf37b
SHA1 hash: 93824d1a053a229de8a204818c900c8054d87815
MD5 hash: fb54d5936b8c83997338f8c0f8108472
humanhash: finch-mirror-yankee-twenty
File name:fb54d5936b8c83997338f8c0f8108472.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:465'408 bytes
First seen:2023-09-03 07:24:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0d5ccc78ff50fbd2fc0370addad4c1f3 (3 x Smoke Loader, 2 x Vidar, 2 x Glupteba)
ssdeep 6144:WmsHM56D6NDsweUDVxLU/Cx71w3NE9s552/Obw/t:DsHM56D6NoAfLUgxeNCsz2/OM/
Threatray 91 similar samples on MalwareBazaar
TLSH T122A4294393E17D58EA258B729F1FCAF8770DF6608E4D7BA922189E2F04B1172C263715
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0000100000020400 (1 x Vidar)
Reporter abuse_ch
Tags:exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
arkei
Create hunting rule
ID:
1
File name:
fb54d5936b8c83997338f8c0f8108472.exe
Verdict:
Malicious activity
Analysis date:
2023-09-03 07:52:59 UTC
Tags:
gcleaner loader stealer arkei vidar
Link:
https://app.any.run/tasks/85682901-047c-48cd-85d2-149d5f159806

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
OnlyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/445811/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Gathering data
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
FickerStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/50408874-4dfa-4192-9930-fee652dbee5a
Result
Threat name:
Vidar, onlyLogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1302329
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected onlyLogger
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1302329 Sample: F5T4MxDTXC.exe Startdate: 03/09/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 10 other signatures 2->51 8 F5T4MxDTXC.exe 19 2->8         started        process3 dnsIp4 39 5.42.64.2, 49722, 49724, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 8->39 41 xxe82.bmtrck.com 3.70.16.242, 49728, 80 AMAZON-02US United States 8->41 43 4 other IPs or domains 8->43 29 C:\Users\user\AppData\...\1573248029.exe, PE32 8->29 dropped 31 C:\Users\user\AppData\Local\...\s51[1], PE32 8->31 dropped 33 C:\Users\user\AppData\Local\...\s51[1], PE32 8->33 dropped 61 Detected unpacking (changes PE section rights) 8->61 63 Detected unpacking (overwrites its own PE header) 8->63 13 cmd.exe 1 8->13         started        15 cmd.exe 1 8->15         started        file5 signatures6 process7 process8 17 1573248029.exe 18 13->17         started        21 conhost.exe 13->21         started        23 taskkill.exe 1 15->23         started        25 conhost.exe 15->25         started        dnsIp9 35 t.me 149.154.167.99, 443, 49733 TELEGRAMRU United Kingdom 17->35 37 116.203.75.210, 49735, 6012 HETZNER-ASDE Germany 17->37 53 Multi AV Scanner detection for dropped file 17->53 55 Detected unpacking (changes PE section rights) 17->55 57 Detected unpacking (overwrites its own PE header) 17->57 59 6 other signatures 17->59 27 WerFault.exe 21 9 17->27         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160/
Threat name:
Win32.Trojan.Lgoogloader
Create hunting rule
Status:
Malicious
First seen:
2023-09-01 18:25:55 UTC
File Type:
PE (Exe)
Extracted files:
79
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwoyiov22nrdasetgnwqoj2vps6u2tcfpyeknvjblqgcjywf6fqa._file
Verdict:
malicious
Similar samples:
0c744dfee7acbaa52ab1fc1c1dd11abe966ea1702585492bdfeefb64d8471412
Vidar
2b937c4be4c13665f3d570e8fbe4585cf52a0e1280ac12e456aa1501eccdafe8
Vidar
33e7df640d73c684871ff3828d1813f000c7a179e06a72f50a2ddefaac434bc8
Vidar
4b91b9c26f507b6d1cf11d20933015290f37f8f19e5d7e56acf7e03dd084ea87
Vidar
69ef6dcea45127b897a23324d41df8acfea240b059f96149c2d89e2ecb2a4983
Vidar
aebd064ece93784e0720d3094ddac5c23ed866f84946c11e23435676458c2f6a
Vidar
c4594c091d25b24860cdee132fce80d16258d7adcbed515f12a62722756f765c
Vidar
dcca1131914f6c8a480e8e0ad87eabb4b85383f804815496cb4f2c2e1a111f39
Vidar
e87a49c8c893c7d984fd1f7b1256f0e377f1ade1327795d917d399ce7b7ed634
Vidar
f52010b1bacbab1cf11cb8c18de051e160613a1e5877ea20ad4920d9f1f8dbd9
Vidar
+ 81 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:b2ced91faf30889899f34458f95b8e93 discovery spyware stealer
Link:
https://tria.ge/reports/230903-h81twsgh68/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar
Malware Config
C2 Extraction:
https://t.me/vogogor
https://steamcommunity.com/profiles/76561199545993403
Unpacked files
SH256 hash:
239ca8d451c72d48f8d4292b3887d10359530974147e273d4fbfdfca48be80ab
MD5 hash:
c8da040d9a65bce8a3253fdad3207ad7
SHA1 hash:
833c71c44afb6a22d05944642c80036a70c13c94
Link:
https://www.unpac.me/results/7b3fb203-a78b-48f0-a874-b7ec3cd65313/
SH256 hash:
5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160
MD5 hash:
fb54d5936b8c83997338f8c0f8108472
SHA1 hash:
93824d1a053a229de8a204818c900c8054d87815
Link:
https://www.unpac.me/results/7b3fb203-a78b-48f0-a874-b7ec3cd65313/
Malware family:
Vidar.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5d9d843abad3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2708737/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/445811/

Comments