MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f
SHA3-384 hash: e9e6d64cce0e73e44f588f1b92de27945b0f37895c633e041244e676f92a199055521ba6a518a4c166b5fb3098ef15a9
SHA1 hash: 12fe967533fde7ed8f74f9c758add00159458afd
MD5 hash: 23acf0e9de75b114816e2e6cf9f625b8
humanhash: mars-east-river-ink
File name:Setup.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:1'448'448 bytes
First seen:2023-02-03 07:48:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:96CXsKY13C0cAzsPAUOxltnuXg6YSorFOnUXfRXO7qJ8mn4/yFG3wJIPqO:9Lsf40cIsPAUKx6YdOUXkqJE6JIPqO
Threatray 2'169 similar samples on MalwareBazaar
TLSH T1EF65D0563A858D41E2EF1137C0BF0D1867B8D88295E2D35BFCAD323E86F6351A80D5DA
TrID 49.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
20.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.7% (.SCR) Windows screen saver (13097/50/3)
7.0% (.EXE) Win64 Executable (generic) (10523/12/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon b2e0b496a6cadaf2 (1 x RaccoonStealer, 1 x ArkeiStealer, 1 x RedLineStealer)
Reporter abuse_ch
Tags:CCleaner exe malvertising vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2023-02-03 07:51:14 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/451838ba-e150-47d8-acab-53859a4c3262

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/359784/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
explorer.exe obfuscated packed shell32.dll
Link:
https://www.filescan.io/uploads/63dcbc6f528134caf0438c08/reports/ab62e54f-d0dc-4931-ac62-9fe9b3d01260/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/77af19eb-ba91-4bc7-86e0-e5e4efa041a4
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1164907
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to compare user and computer (likely to detect sandboxes)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6mqhe4y6zhmvlunkmwoct6sdb7irhiy5sopcs3nrx6gkorrlbhq._file
Verdict:
malicious
Similar samples:
117bd2c9e3129351eed6cb440c52bbf570b3ed971053f66d5a6ebd012b281731
Vidar
16d90becedc8db98707d9959052f4e686066eab7ae751b1582016602d5208600
Vidar
366e015f3ab40776810c6c6b3e2c26c294311ff0b7f3232ce7ad2a3445649301
Vidar
934be33621f60d5c6026af662631a4de2c054ccd0f132b268e721c73afc8aa37
Vidar
ccd8f858057e8f7b43f3ae2490de946c65dab843514f0239bd9f50ba207fb8da
Vidar
ce6cc42aa09da7448f7ba9a992584cdd69e76b3759edfabb1cfcadea4edf2abe
Vidar
cf7e87560e6226eca45aa85b0b0b7b0791c08a94c105e7263cd762a56b02154b
Vidar
db63bcace9a0c31bb174200f93661ff44664634a56b4c05145bbf382d33451f8
Vidar
e9dfa7091ae536608ed7d95240cb6abba1033e14af969d271c804edf477ea387
Vidar
ee80016e8f3281ce593898821850463ae7bff86c63be1fcc79d15333531e791d
Vidar
+ 2'159 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:855 discovery spyware stealer
Link:
https://tria.ge/reports/230203-jnn52acg82/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Vidar
Malware Config
C2 Extraction:
https://t.me/mantarlars
https://steamcommunity.com/profiles/76561199474840123
Unpacked files
SH256 hash:
109d50a78bcec56cfa943252d051415a04d12301dec968c9009679f8a84c9554
MD5 hash:
1dfcf0fd732750226e5341fc7a06ae9f
SHA1 hash:
ddb7f85ae7f5d195db0ab8ed3944856375b9c5f1
Link:
https://www.unpac.me/results/7c061703-d556-44d5-9025-f86c7a0ae56a/
SH256 hash:
94c2ba257a21a0eb4527346753abdedc7bb2fe3aa72d20642546994626602129
MD5 hash:
874dcc6be499121b1425bfdff1f8ad46
SHA1 hash:
66f83bedc73876b77e152c604b8214bde86d965e
Link:
https://www.unpac.me/results/7c061703-d556-44d5-9025-f86c7a0ae56a/
SH256 hash:
6469be606545a12a350161fe6c4a166978cbc4c386a4fab8ee19ad58fedf6b2b
MD5 hash:
04c30f20973d2594fe2eeb865a75da0b
SHA1 hash:
65a86fa2d5ece6b17e1b47b9d385c867b90ce9ae
Detections:
VidarStealer
Create hunting rule
Link:
https://www.unpac.me/results/7c061703-d556-44d5-9025-f86c7a0ae56a/
SH256 hash:
6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f
MD5 hash:
23acf0e9de75b114816e2e6cf9f625b8
SHA1 hash:
12fe967533fde7ed8f74f9c758add00159458afd
Link:
https://www.unpac.me/results/7c061703-d556-44d5-9025-f86c7a0ae56a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6799039398f64ecaae8d532ce14fd2187e889d18ec9cf14b6d8dfc653a31584f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:NETDIC208_NOCEX_NOREACTOR
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/359784/

Comments