MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 12 File information Comments

SHA256 hash:	afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5
SHA3-384 hash:	fb2d0a95b4ccdab0c82f8a5fb6036de8f30c05dba6f8bcbfcc94d19ecea141e8a79ff1297f0d12b71bc488fe52426442
SHA1 hash:	b87e40cee60869a36e79c88c8a3a34baf0bc4889
MD5 hash:	8dae8b6a6be6e3527183594d1c26a2d3
humanhash:	west-echo-jersey-sweet
File name:	8dae8b6a6be6e3527183594d1c26a2d3.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	283'648 bytes
First seen:	2024-03-28 07:00:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e381a5a93083caf35e69fd7d319ba0c4 (2 x Stealc, 2 x AveMariaRAT, 1 x Vidar)
ssdeep	6144:GtcSsUDC2OZuhYRQqPY3x/OKV/LYZsTZgzENh+a1:TSsUO2cuhY1m/VYZsI
TLSH	T11D548C2176F58435F3F79E3059B3A6950A7BB8737E34818F2668122A5E317C18E72723
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	3370ecdaccf0335a (3 x Stealc, 2 x GCleaner, 1 x LummaStealer)
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

330

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

New Text Document.bin.exe

Verdict:

Malicious activity

Analysis date:

2024-03-27 21:29:19 UTC

Tags:

loader hausbomber stealer redline opendir stealc amadey botnet evasion xworm remote risepro agenttesla

Link:

https://app.any.run/tasks/4c00d8a1-25d5-4174-acc3-55252b5685be

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

Behavior that indicates a threat

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Launching a process

Moving a file to the Program Files subdirectory

Replacing files

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/660515aff5193ebf8f41d863/reports/35b920cf-70e6-46b2-a028-f07cc73af607/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Vidar

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d0cf7248-7c5f-45df-840b-cc0178c1e004

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1416847

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected AntiVM3

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5/

Threat name:

Win32.Trojan.Krypter

Status:

Malicious

First seen:

2024-03-27 17:28:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 23 (95.65%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v7hhftj3y4l4pbewecbqm3r63yvqvkw34cii5rzwaclmsi3xj6sq._file

Verdict:

malicious

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:5739ef2bbcd39fcd59c5746bfe4238c5 stealer

Link:

https://tria.ge/reports/240328-hs7x9sfa6y/

Behaviour

Modifies system certificate store

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Detect Vidar Stealer

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok

Unpacked files

SH256 hash:

b1613da97406e039910cecd0327765a2c6477057c9ea8197e967c2fddcb7af6a

MD5 hash:

d5278c37d49c8ca62cb176ca9e4576cd

SHA1 hash:

08a57c20629cad29627a359c4fa95349b13a45c6

Detections:

VidarStealer

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/0303721f-9638-4820-81e0-11b500c2ff7d/

SH256 hash:

afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

MD5 hash:

8dae8b6a6be6e3527183594d1c26a2d3

SHA1 hash:

b87e40cee60869a36e79c88c8a3a34baf0bc4889

Link:

https://www.unpac.me/results/0303721f-9638-4820-81e0-11b500c2ff7d/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/afce72cd3bc7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	Windows_Generic_Threat_c374cd85 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2791468/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindNextVolumeMountPointW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetConsoleTitleA KERNEL32.dll::SetConsoleTitleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasExesLengthA KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileA KERNEL32.dll::CreateFileW KERNEL32.dll::GetFileAttributesA
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpOpen
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyW
WIN_TIME_API	Can Modify Time	KERNEL32.dll::SetSystemTime

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample