MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 14

Intelligence 14 IOCs YARA 24 File information Comments

SHA256 hash:	c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa
SHA3-384 hash:	328a69f7f8611105c426204f2d66a22c965c86b042a8bf0850b24bc1fc7c9cffe3104f1c27fc99cda253ea183a1b2912
SHA1 hash:	16482b513fcdbb46f528a079ce3942314ece1b3f
MD5 hash:	7600933588af5a44bf63ab0829534f8a
humanhash:	video-six-music-mobile
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	302'592 bytes
First seen:	2023-12-01 11:50:07 UTC
Last seen:	2023-12-03 07:31:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e8e51dea98dc7701b104446165cbe5db (5 x Stealc, 4 x Smoke Loader, 2 x Tofsee)
ssdeep	6144:Vh0Ej+3Mh8dV5MRWTa03cMMTmFAKo58oWnIoQGPRqa6Z3h+V/9H:VAMh8dVu8u5TmCZ8hnIoQGPR96ZMF
TLSH	T16154D011B6D0C832E1971A350861CAA25A37FCA29B7295CB27943F3E6D317D1CB79703
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	1090c848d0626260 (1 x Vidar)
Reporter	andretavare5
Tags:	exe vidar

andretavare5

Sample downloaded from http://gons34cl.top/build.exe

Intelligence

File Origin

# of uploads :

# of downloads :

352

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

https://rodhigital.com/aladin/release_v9.rar

Verdict:

Malicious activity

Analysis date:

2023-12-01 11:16:05 UTC

Tags:

privateloader evasion loader stealer redline stealc ransomware stop tofsee botnet risepro miner smoke smokeloader sinkhole xworm g0njxa

Link:

https://app.any.run/tasks/fc4c4f4b-c9cc-4bf4-bed7-c6a093d10dc0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/461703/

Detection(s):

Win.Dropper.Tofsee-10015945-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Gathering data

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dcff3136-fb36-4381-ac16-20c2f1d1a864

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1351365

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2023-12-01 11:51:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ylc5ggn4l7scjkhkikuge3owxe5sp4nchksfmeo7bhwpkxp2dx5a._file

Verdict:

malicious

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:52d67d34ad338b1aab9d89c0da5a59b1 stealer

Link:

https://tria.ge/reports/231201-nz5pdahe62/

Behaviour

Modifies system certificate store

Program crash

Vidar

Malware Config

C2 Extraction:

https://t.me/s4p0g
https://steamcommunity.com/profiles/76561199575355834

Unpacked files

SH256 hash:

0eb80c05ac737a24895a2aa7cc90efcc0d35b2e69dde344456777905927f48b7

MD5 hash:

8b6e28563af97951eef7a77160ebd85d

SHA1 hash:

da17ace60230151a19380c8d901e86282edd8988

Detections:

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/3fdc586d-d330-4d4f-b46f-3e5bb7cae6c1/

Parent samples :

cc58fda6767d3d05772223f4267075b2dc2a63bc802a6026f3dbc1403e3efa17
c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa

SH256 hash:

c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa

MD5 hash:

7600933588af5a44bf63ab0829534f8a

SHA1 hash:

16482b513fcdbb46f528a079ce3942314ece1b3f

Link:

https://www.unpac.me/results/3fdc586d-d330-4d4f-b46f-3e5bb7cae6c1/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c2c5d319bc5f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifcats referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_vidar Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detection of Vidar Stealer and Variants via strings present in final unpacked payloads

Rule name:	win_vidar_strings_jun_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detection of Vidar Stealer and Variants via strings present in final unpacked payloads