MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 17


Intelligence 17 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6
SHA3-384 hash: a77f673fa5efc1eca1d1630d6d13c069d24d9b752667d329cc8f7a6dd5a8779e3a360d9b1f094592a88ca3699b0b1915
SHA1 hash: 1487fcbdae76e1ebb5d55b9f76692959dd2cd5a6
MD5 hash: 680af4923dc7b8ce1c06516ce06d17d3
humanhash: cardinal-bakerloo-four-delta
File name:680af4923dc7b8ce1c06516ce06d17d3.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:8'242'176 bytes
First seen:2024-08-03 07:21:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 67 x LummaStealer, 61 x Rhadamanthys)
ssdeep 196608:R6q51jd2HCwufvfbc7Mh7gOwQc5zlSJp0IV3DtBmS1aj9lF9q:RBd2HgfXbqMh7Ux5zgb0KRkS1YHj
Threatray 5'394 similar samples on MalwareBazaar
TLSH T1E086336286F8939CC1C5A678C8F9035308B679604BF89EEF42D92B745F1A1CD34B9F49
TrID 58.9% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
16.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
10.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.1% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
680af4923dc7b8ce1c06516ce06d17d3.exe
Verdict:
Malicious activity
Analysis date:
2024-08-03 07:34:02 UTC
Tags:
netreactor opendir stealer vidar
Link:
https://app.any.run/tasks/f5465606-7b9f-4072-b433-07dbc58e8b42

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66acfec7b7a04efc7439ac27
Tags:
Execution Generic Infostealer Network Other Static Stealth Trojan
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Launching a process
Сreating synchronization primitives
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a recently created process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
90%
Tags:
advpack CAB explorer installer lolbin microsoft_visual_cc packed rundll32 setupapi sfx shell32 vidar
Link:
https://www.filescan.io/uploads/66addaa49149fd55f993f79a/reports/78165a4c-95e7-4d3f-af4e-99fcf9af4aed/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b1a6167f-3f45-49a3-b3fa-5726bde7f2eb
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1487171
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Powershell download and execute
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1487171 Sample: 9haLpdq35X.exe Startdate: 03/08/2024 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for URL or domain 2->49 51 12 other signatures 2->51 8 9haLpdq35X.exe 1 4 2->8         started        11 rundll32.exe 2->11         started        process3 file4 39 C:\Users\user\...\theoryspeciallized.exe, PE32 8->39 dropped 41 C:\Users\user\...\theoryspecialized.exe, PE32 8->41 dropped 13 theoryspecialized.exe 15 4 8->13         started        17 theoryspeciallized.exe 4 8->17         started        process5 dnsIp6 43 45.86.86.75, 49736, 80 DALANETKZ Italy 13->43 53 Antivirus detection for dropped file 13->53 55 Multi AV Scanner detection for dropped file 13->55 57 Machine Learning detection for dropped file 13->57 59 3 other signatures 13->59 19 cmd.exe 1 13->19         started        21 AppLaunch.exe 13->21         started        23 AppLaunch.exe 13->23         started        27 3 other processes 13->27 25 cmd.exe 17->25         started        signatures7 process8 process9 29 conhost.exe 19->29         started        31 timeout.exe 1 19->31         started        33 WerFault.exe 22 18 21->33         started        35 conhost.exe 25->35         started        37 timeout.exe 1 25->37         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6/
Threat name:
ByteCode-MSIL.Dropper.Vidar
Create hunting rule
Status:
Malicious
First seen:
2024-08-02 15:02:57 UTC
File Type:
PE+ (Exe)
Extracted files:
56
AV detection:
21 of 24 (87.50%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nltagdtcekquadhjhdrk2iegeu7r75wz2b5qxy275zufh2d35xda._file
Verdict:
malicious
Similar samples:
1ebdbd7b94a764479be0363d620c6c6b2b41b5b55888c9546b22d050835b22ea
Vidar
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2
Vidar
5c415a3f7d2dfc912447dfde68e67c6b90cc0fd07011f8bd062390ad72111609
Vidar
6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6
Vidar
7e97e6e6ccae12c62ee828a165fc3c0945026440716621d90abc77a1f7fc5c62
Vidar
a2966acf8a8e52e6ad8f0830ab83710680365608cba771b334314b9123def291
Vidar
+ 5'384 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar credential_access discovery persistence spyware stealer
Link:
https://tria.ge/reports/240803-h68rqa1dpb/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Credentials from Password Stores: Credentials from Web Browsers
Detect Vidar Stealer
Vidar
Malware Config
C2 Extraction:
https://steamcommunity.com/profiles/76561199747278259
https://t.me/armad2a
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2f9c6b85-3891-4b45-bb66-dd130c9929d8
Unpacked files
SH256 hash:
7de8d59387105f4d8d7b721cc7ac5202c9735162f5e56d53a32915568e5c9b6f
MD5 hash:
19994cf76dff91cc200e41ec7f616e88
SHA1 hash:
ec7757228810c3ec63dd8c99f89b0f0051133d6e
Link:
https://www.unpac.me/results/1211d0cc-a211-466c-b714-a7b3b10efccf/
SH256 hash:
4c9f676b75807cb98edeba860a97a42a6451191006627c0ed9f55753e24cd8d3
MD5 hash:
4a611572dfebc90e58361a47f7c7b931
SHA1 hash:
6eb472c77fe28d927757bc48917aa1356f9ef1a6
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/1211d0cc-a211-466c-b714-a7b3b10efccf/
SH256 hash:
6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6
MD5 hash:
680af4923dc7b8ce1c06516ce06d17d3
SHA1 hash:
1487fcbdae76e1ebb5d55b9f76692959dd2cd5a6
Link:
https://www.unpac.me/results/1211d0cc-a211-466c-b714-a7b3b10efccf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ae6030e6222a1400ce938e2ad2086253f1ff6d9d07b0be35fee6853e87bedc6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::EqualSid
ADVAPI32.dll::FreeSid
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetVolumeInformationA
KERNEL32.dll::GetSystemInfo
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::GetSystemDirectoryA
KERNEL32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryInfoKeyA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::PeekMessageA

Comments