MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e
SHA3-384 hash: 2d38cb1b58ac84a94709b03ebda2ceb1d8e4d5ed0242f339c1de036a86137e6993b088c69c73eec0669fbe0651fcd157
SHA1 hash: 1870e0232030e0e8114f842e652d3d43629d16d9
MD5 hash: a2968948684f7b6a4f35a236fa4b5c3f
humanhash: echo-music-stairway-kilo
File name:setup.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:484'472 bytes
First seen:2023-03-05 09:28:57 UTC
Last seen:2023-03-05 11:27:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f635647f64b745c77efa805ab50ac90 (2 x RecordBreaker, 1 x Vidar, 1 x LaplasClipper)
ssdeep 12288:GHWwEHJPmCA24KCtvyljdufthYaNmMY/Cjb:GHWwWPmvQCtv05IPmMY/C/
Threatray 589 similar samples on MalwareBazaar
TLSH T144A4E00B76CCC33EE52EE37869824019A87997306F5F115B6B29B51D3AECBE02175B13
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter MalwareSearcher
Tags:exe malware vidar


Avatar
MalwareSearcher
https://www.youtube.com/watch?v=H5FJqpOcVKQ
Link: https://bit.ly/41Ycs7R
Password: 7573

Intelligence

File Origin
# of uploads :
2
# of downloads :
349
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup.exe
Verdict:
Malicious activity
Analysis date:
2023-03-05 09:30:38 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/26305052-b1f3-4c57-8ef4-1ddef5f79332

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371699/
Detection(s):
SecuriteInfo.com.Variant.Tedy.239942.21472.3294.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/640460df03b144271569d5a9/reports/3db7d9ad-3d01-4c0b-afde-fee9358ac9b5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d0d9e221-077c-4091-b4c3-7719822aae16
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1187332
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to compare user and computer (likely to detect sandboxes)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2023-03-05 09:48:40 UTC
File Type:
PE (Exe)
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tuk4kttfoqptjmdmeivvyek7khvuf45xbbp4nlyoqujsylbjtzpa._file
Verdict:
malicious
Similar samples:
36b03249d7ae407da7b955d538e660eae8d3562a091393bb81c5b457ebfe83ae
Vidar
3e38c14c9a27966b7768fa6a61a0bc86b79fdf8f554d232c26d0a13cd8dcdc36
Vidar
48aa1381548b2590a3ae1d740852fdefdf51c46666ee2d86e50aeae66afbda60
Vidar
733501d537884cca4a051c6669c594411f55c910a4b71a0d31e5c622641b841d
Vidar
807dba280d2922afbdb7334fe3e0a602f59dcf597276c6b4948e8140090bc19b
Vidar
82cc542ba58a3f7f875d765e60bc4829593c15d35f1c619ae08bcabded33808d
Vidar
8f0d2909498e32a88ea7a3873958edd5456e0d9d3e766ce7c8bcc303f67d8984
Vidar
b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6
Vidar
daeb55142c78a55a7f9b43b839d3d0708c8f0739fe260366070330876e72a340
Vidar
e282e8a40a9f9c66e32ff63aa62ea236f642110e79047a3c3d00428df09536a6
Vidar
+ 579 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar spyware stealer upx
Link:
https://tria.ge/reports/230305-lfw7sagb77/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
Downloads MZ/PE file
Vidar
Unpacked files
SH256 hash:
6a6fcb4d796b0a0fe81a02194d7f00077128224d6d28318efe3b583ac8939071
MD5 hash:
111d53fdc99483abb6fb55269193bd15
SHA1 hash:
403a92e1ea1a83afb6ee1c62012f8e5d4da3341e
Link:
https://www.unpac.me/results/a75f0fd3-7ffd-43e5-8b82-3268cd547e7a/
SH256 hash:
9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e
MD5 hash:
a2968948684f7b6a4f35a236fa4b5c3f
SHA1 hash:
1870e0232030e0e8114f842e652d3d43629d16d9
Link:
https://www.unpac.me/results/a75f0fd3-7ffd-43e5-8b82-3268cd547e7a/
Malware family:
Vidar.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d15c54e6574/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Telegram_Links
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 9d15c54e65741f34b06c222b5c115f51eb42f3b7085fc6af0e85132c2c299e5e

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/371699/

Comments