MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments

SHA256 hash:	810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f
SHA3-384 hash:	f67f934427d3c1e6684c49a5740a90cb9de34a19cd9a7c928c575f3445d9cc213e9c949d39dce827c4190d21028d64b2
SHA1 hash:	db640ebdfc3b98fe7a8223a44f4e997fa28cacc0
MD5 hash:	a5293cb8841eb96b8a6618f1e11cb730
humanhash:	iowa-hotel-lamp-alabama
File name:	a5293cb8841eb96b8a6618f1e11cb730.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	415'744 bytes
First seen:	2023-05-02 09:32:30 UTC
Last seen:	2023-05-13 22:46:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	203b54dd7cb5052a152152d37aa392da (6 x RedLineStealer, 3 x Tofsee, 1 x TeamBot)
ssdeep	6144:VTIN6lFfkmWZ36iEV1JBO1N6tmuEJTX8Td3dl9Ytqv+S:+N6lFcm66i60NJQkHS
Threatray	2 similar samples on MalwareBazaar
TLSH	T144945A1392E13D44EA2A8F72DF2FC6EC7A8DF2509E493775121A9A1F49B01B3D263711
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	00089190848b8882 (1 x Vidar)
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

240

Origin country :

Vendor Threat Intelligence

Malware family:

vidar

ID:

File name:

a5293cb8841eb96b8a6618f1e11cb730.exe

Verdict:

Malicious activity

Analysis date:

2023-05-02 09:41:46 UTC

Tags:

stealer vidar trojan arkei

Link:

https://app.any.run/tasks/d1a3b315-4514-4071-b069-48833bb4a370

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/386035/

Detection(s):

Sanesecurity.Malware.29231.BadIN.UNOFFICIAL

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Using the Windows Management Instrumentation requests

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed xpack

Link:

https://www.filescan.io/uploads/6450d8cfd7f41b9c6731609a/reports/e9fb40a9-e7c5-481f-a0a9-c663d329eda1/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c4f1cbeb-22c6-4afc-aa01-a8a91f4ce0ed

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1224530

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-05-01 17:31:53 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qef6o2xd5tc2w7ybt6izpgwj5p3w5urau62cyisuuipmmyhyfcpq._file

Verdict:

malicious

Vidar

7f5027cce0e8aa45f9a86b13328ce878fd640137449638ea0bc28be155e311ad

Vidar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:31c7719b5ee962fbde376b75e771360d discovery spyware stealer

Link:

https://tria.ge/reports/230502-lh65rsad86/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199501059503
https://t.me/mastersbots

Unpacked files

SH256 hash:

6db44d9eaefc66aca60710f2c24e04a1d4d9f1aa032707b895198130720f6344

MD5 hash:

a7c1683119334a74ca6684b4de952567

SHA1 hash:

6160a36b52a3e6f6fb180a78cbf9a205266465f7

Detections:

VidarStealer

Link:

https://www.unpac.me/results/d173a2cb-3fc3-4a02-8bbb-0d2eaafa424f/

SH256 hash:

810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f

MD5 hash:

a5293cb8841eb96b8a6618f1e11cb730

SHA1 hash:

db640ebdfc3b98fe7a8223a44f4e997fa28cacc0

Link:

https://www.unpac.me/results/d173a2cb-3fc3-4a02-8bbb-0d2eaafa424f/

Malware family:

Vidar.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/810be76ae3ec/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	Telegram_Links Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe 810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2615177/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/386035/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample