MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b
SHA3-384 hash: 560d271edaea7317235717c44e8d820c35df181aa3239a229c81786ef2e87ead0a44e38cc42eec1eeb54ff49e7ba29d0
SHA1 hash: f417394441a253f7f0ef661b00905fa51c71b4fc
MD5 hash: d2192209d6892b9bf8e6d155a53b69a5
humanhash: twelve-mexico-mars-fanta
File name:d2192209d6892b9bf8e6d155a53b69a5.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:3'437'696 bytes
First seen:2023-07-19 12:46:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:B9fBVAeoycp8DtPCrZPKh0wCqMEvhuwteJoltx6I+PGnGToq5aOCDDHV3:BnVAeh+8Dtqtyh5Iw4qZoGnZOCfHl
Threatray 682 similar samples on MalwareBazaar
TLSH T187F5334D2C681E85FAF80EF88EF9813859201CD57448D76BBCADA5DF2F3A860F411D86
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon fcece4f8e0e4c8fc (1 x Vidar)
Reporter abuse_ch
Tags:exe signed vidar

Code Signing Certificate

Organisation:Hewlett-Packard Company
Issuer:Hewlett-Packard Company
Algorithm:sha1WithRSAEncryption
Valid from:2023-07-16T17:53:21Z
Valid to:2033-07-17T17:53:21Z
Serial number: 19c7e09e1425d8b8485da7438ffd570c
Intelligence: 15 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 6ba12c4c5504cad206d7bafb82e4c596759828e45bf51b0aaefa99ea5eb20187
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
302
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
e38a25843e899a667951413c11331319.exe
Verdict:
Malicious activity
Analysis date:
2023-07-19 12:18:14 UTC
Tags:
rat redline amadey trojan loader stealer vidar arkei
Link:
https://app.any.run/tasks/91f362da-016c-4b66-90aa-7dbdf539db19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/424856/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.25993.24570.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed packed
Link:
https://www.filescan.io/uploads/64b7db4af52c3e1a014a748f/reports/535d8d3f-a0fb-4244-996b-3894647b15d7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkBit
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/831b8c8d-437b-4a5a-a25f-9745ea88174d
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1275951
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Searches for specific processes (likely to inject)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1275951 Sample: a1rk9gskRr.exe Startdate: 19/07/2023 Architecture: WINDOWS Score: 100 65 Multi AV Scanner detection for domain / URL 2->65 67 Found malware configuration 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 10 other signatures 2->71 9 a1rk9gskRr.exe 1 2->9         started        13 DotNetServer.exe 6 2->13         started        process3 dnsIp4 53 C:\Users\user\AppData\...\a1rk9gskRr.exe.log, ASCII 9->53 dropped 91 Detected unpacking (changes PE section rights) 9->91 93 Query firmware table information (likely to detect VMs) 9->93 95 Tries to detect sandboxes and other dynamic analysis tools (window names) 9->95 103 5 other signatures 9->103 16 AppLaunch.exe 24 9->16         started        61 94.142.138.119 IHOR-ASRU Russian Federation 13->61 63 t.me 13->63 97 Multi AV Scanner detection for dropped file 13->97 99 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->99 101 Machine Learning detection for dropped file 13->101 file5 signatures6 process7 dnsIp8 55 t.me 149.154.167.99, 443, 49696 TELEGRAMRU United Kingdom 16->55 57 94.142.138.116, 49698, 80 IHOR-ASRU Russian Federation 16->57 59 2 other IPs or domains 16->59 43 C:\Users\user\AppData\Local\...\clp8[1].exe, PE32 16->43 dropped 45 C:\Users\user\AppData\Local\...\bebra[1].exe, PE32+ 16->45 dropped 47 C:\ProgramData\35270414194783400988.exe, PE32+ 16->47 dropped 49 C:\ProgramData\25885480533678696129.exe, PE32 16->49 dropped 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->73 75 Tries to harvest and steal browser information (history, passwords, etc) 16->75 77 Tries to steal Crypto Currency Wallets 16->77 79 Searches for specific processes (likely to inject) 16->79 21 25885480533678696129.exe 3 16->21         started        25 35270414194783400988.exe 16->25         started        27 cmd.exe 1 16->27         started        file9 signatures10 process11 file12 51 C:\ProgramData\...\DotNetServer.exe, PE32 21->51 dropped 81 Multi AV Scanner detection for dropped file 21->81 83 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 21->83 85 Machine Learning detection for dropped file 21->85 87 Uses schtasks.exe or at.exe to add and modify task schedules 21->87 29 schtasks.exe 1 21->29         started        89 Tries to harvest and steal browser information (history, passwords, etc) 25->89 31 cmd.exe 1 25->31         started        33 conhost.exe 27->33         started        35 timeout.exe 1 27->35         started        signatures13 process14 process15 37 conhost.exe 29->37         started        39 conhost.exe 31->39         started        41 choice.exe 1 31->41         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-07-19 12:33:20 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzco2ec3cieky7jf3y3hki5oybhvhqmmndl6hcoyskqjgdf2qyfq._file
Verdict:
malicious
Similar samples:
20fa6136a8a585a8f30110a5dd5fa9d8b2f9a2ee0eff590a721656eb44eceea0
Vidar
2beabdd285adf915fc07418c5f9e57cc4430f766b838e1726570c21af4868f18
Vidar
3dff203bab1db4bd7012e5daa23e467f7919587e5a306e497edb85caa2497dbe
Vidar
46ef6daecec030061841713f7afb387a0a7ce913e2a5d63bc46126628daf19e1
Vidar
5669ab68f0fce15c35dbc9c52d5bd15ca7359901c8e6d4f3a3e32221b6a0e6bb
Vidar
753fbc1dfa05d6007c5dfa534a7d019cbb24d07224b67ae9d48c9772039c63cd
Vidar
8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c
Vidar
96e49850a66d17e4952c6753db1f3da67f8c49c23a2297891954df55b144d1a8
Vidar
c06a41f8cc26ea5c1258decc9ac07f2014b29266b4a3a7c0d7183dbc706ffeed
Vidar
cc0f70f4c9b185dacf984c2f7f721d11ad293a7e2b654fbf26180e7ebfe54f81
Vidar
+ 672 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:https://t.me/sundayevent evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/230719-pz7peaeh59/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar
Malware Config
C2 Extraction:
https://t.me/sundayevent
https://steamcommunity.com/profiles/76561198982268531
Unpacked files
SH256 hash:
46d6cf2887bcd3e23dc77e4246ae147df00ebb69c58fce653e90271f17c1a493
MD5 hash:
63f060aa05e8364d77c00c66fd17c086
SHA1 hash:
c656287e6da6da69e2efd28aea4b6702db43f780
Link:
https://www.unpac.me/results/e24739cc-40db-49f0-938c-623276edf438/
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/e24739cc-40db-49f0-938c-623276edf438/
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/e24739cc-40db-49f0-938c-623276edf438/
SH256 hash:
b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b
MD5 hash:
d2192209d6892b9bf8e6d155a53b69a5
SHA1 hash:
f417394441a253f7f0ef661b00905fa51c71b4fc
Link:
https://www.unpac.me/results/e24739cc-40db-49f0-938c-623276edf438/
Malware family:
Vidar.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b644ed105b12/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
vidar
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2685792/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/424856/

Comments