MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728
SHA3-384 hash: 824373370c5c648f23bf77c7506853769355678000553413dec11c339014c8c6e66346299982a40941d4c993dcf581bd
SHA1 hash: 26b2d2ed94bea477e82f1dfe490aff259824ac5d
MD5 hash: 1f2c4ac075b7a79917c290f0b9fd27b6
humanhash: november-vegan-fish-robert
File name:Portals.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:152'576 bytes
First seen:2025-03-13 16:54:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'197 x AgentTesla, 20'351 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 3072:b3GqXhaXFCV70nVvzvgQMjTjm5qCxBfSIEt/4EIOxhy/fFqBO0A3UQ6oaJ:Jx6Fw70VvzgQMjTj0xB2ZnaFkgGJ
TLSH T142E31254EEF2D6B6F06D0E3A19FB8DC97651F2613889713E41CFA3022AAA1EC1567740
TrID 66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.5% (.EXE) Win64 Executable (generic) (10522/11/4)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter BastianHein
Tags:exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
404
Origin country :
CL CL
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
Portals.exe
Verdict:
Malicious activity
Analysis date:
2025-03-13 17:21:12 UTC
Tags:
telegram vidar stealer
Link:
https://app.any.run/tasks/b24394f9-5c63-4947-8008-a72fdfe7d9ea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d31d213962f1a6f470e664
Tags:
emotet micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Restart of the analyzed sample
Searching for synchronization primitives
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP GET request
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67d30dfe79538fa3d3c7f586/reports/04757d6b-ed64-4a19-8848-70a14e1296db/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f4c69b72-ea02-4aef-953c-df64829490c8
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1637568
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Self deletion via cmd or bat file
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1637568 Sample: Portals.exe Startdate: 13/03/2025 Architecture: WINDOWS Score: 100 33 b.b.goldenloafuae.com 2->33 35 t.me 2->35 37 steamcommunity.com 2->37 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 6 other signatures 2->57 9 Portals.exe 2->9         started        signatures3 process4 signatures5 59 Attempt to bypass Chrome Application-Bound Encryption 9->59 61 Self deletion via cmd or bat file 9->61 63 Contains functionality to inject code into remote processes 9->63 65 2 other signatures 9->65 12 Portals.exe 29 9->12         started        16 WerFault.exe 21 16 9->16         started        process6 dnsIp7 45 b.b.goldenloafuae.com 94.130.189.58, 443, 49724, 49727 HETZNER-ASDE Germany 12->45 47 t.me 149.154.167.99, 443, 49720, 49737 TELEGRAMRU United Kingdom 12->47 49 3 other IPs or domains 12->49 67 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->67 69 Found many strings related to Crypto-Wallets (likely being stolen) 12->69 71 Self deletion via cmd or bat file 12->71 73 4 other signatures 12->73 19 chrome.exe 12->19         started        22 cmd.exe 1 12->22         started        31 C:\ProgramData\Microsoft\...\Report.wer, Unicode 16->31 dropped file8 signatures9 process10 dnsIp11 39 192.168.2.4, 138, 443, 49709 unknown unknown 19->39 24 chrome.exe 19->24         started        27 conhost.exe 22->27         started        29 timeout.exe 1 22->29         started        process12 dnsIp13 41 142.250.186.132, 443, 49769, 49770 GOOGLEUS United States 24->41 43 www.google.com 24->43
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728/
Threat name:
ByteCode-MSIL.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-03-08 19:29:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pn7u6fea6ydlbze23ytt3vt77gtdnrbiggp6a5hz3ggq65tbe4ua._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
Similar samples:
error
Vidar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:a32471de8323c66de43eb8313e806fea credential_access discovery spyware stealer
Link:
https://tria.ge/reports/250313-ve7fssxyew/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Uses browser remote debugging
Detect Vidar Stealer
Vidar
Vidar family
Malware Config
C2 Extraction:
https://t.me/l793oy
https://steamcommunity.com/profiles/76561199829660832
Verdict:
Malicious
Tags:
Win.Packed.Msilzilla-10042543-0 stealc
YARA:
n/a
Link:
https://app.threat.zone/submission/26863786-ec26-4de2-b853-e729add14d91
Unpacked files
SH256 hash:
7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728
MD5 hash:
1f2c4ac075b7a79917c290f0b9fd27b6
SHA1 hash:
26b2d2ed94bea477e82f1dfe490aff259824ac5d
Link:
https://www.unpac.me/results/f2f3e1e0-0020-4f99-96c8-25900e9c0bc0/
SH256 hash:
cab52ff59ed0940a8dcad047c3b96e5f830ccf6c26a3b77af271600bf076f1cc
MD5 hash:
6da30e0db57d16878b7ec6c566c7f647
SHA1 hash:
30ab602f6fa43316d08bc25d329addbbe80db82d
Detections:
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Link:
https://www.unpac.me/results/f2f3e1e0-0020-4f99-96c8-25900e9c0bc0/
Malware family:
CryptBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7b7f4f1480f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments