MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 9 File information Comments 1

SHA256 hash:	e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b
SHA3-384 hash:	dabfecd9938443cb9a995f6c5149f1ff738368a6936f831f16df3b0c313a9b6c2d078280bbf59fc8bb7304d3911f43d4
SHA1 hash:	5cee7ed20e4d49778c8a7ec88f9b24c395fd7f97
MD5 hash:	2edc8c65202a68d10cb4d775ba91ed1b
humanhash:	seventeen-robin-tennis-eleven
File name:	2edc8c65202a68d10cb4d775ba91ed1b
Download:	download sample
Signature	Vidar Create hunting rule
File size:	322'560 bytes
First seen:	2023-09-14 11:11:52 UTC
Last seen:	2023-09-14 11:49:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f2222f0f215a06acc111aee4e181dfd8 (1 x Vidar)
ssdeep	6144:aLhLW8KrV1R/2XJtCTHI41wuBdqv2UxgueIseSq7Lmh+br:4horV1p2XQZMv2UxgueIsG7L
Threatray	1 similar samples on MalwareBazaar
TLSH	T185647E16B380E432D2535939DE6AE3734BBF2C7228255257FFC415AE3DB06D29A2434B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

320

Origin country :

Vendor Threat Intelligence

Malware family:

arkei

ID:

File name:

2edc8c65202a68d10cb4d775ba91ed1b

Verdict:

Malicious activity

Analysis date:

2023-09-14 11:13:16 UTC

Tags:

stealer arkei vidar

Link:

https://app.any.run/tasks/5b579e96-0b1b-42cf-8481-c024eca85ec4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/448614/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.21178.29934.UNOFFICIAL

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm control evasive greyware lolbin

Link:

https://www.filescan.io/uploads/6502ea847aa68bd3a1f9e896/reports/ee40543b-8f1a-4782-be1c-ecb6e0a1ebd6/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Arkei Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e6545225-aa6f-4a88-97c4-b292946cc1ea

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1307714

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-09-14 11:12:06 UTC

File Type:

PE (Exe)

AV detection:

16 of 22 (72.73%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4d3w73cg2wrwp7pmm6766er4wovxy3l634xp2ff2jsnwgxog4nfq._file

Verdict:

malicious

Vidar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:1dab505a37b1d9f441e6205dfb0c427a discovery spyware stealer

Link:

https://tria.ge/reports/230914-natwksbf3x/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Accesses 2FA software files, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199550790047
https://t.me/bonoboaz

Unpacked files

SH256 hash:

e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b

MD5 hash:

2edc8c65202a68d10cb4d775ba91ed1b

SHA1 hash:

5cee7ed20e4d49778c8a7ec88f9b24c395fd7f97

Detections:

VidarStealer

Link:

https://www.unpac.me/results/52046388-9d62-4b58-93f0-4f02e7eb3471/

Malware family:

Vidar.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e0f76fec46d5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	Telegram_Links Create hunting rule

Rule name:	Vidar Create hunting rule
Author:	kevoreilly,rony
Description:	Vidar Payload

Rule name:	win_vidar_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2711677/

Cape

https://www.capesandbox.com/analysis/448614/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-09-14 11:11:53 UTC

url : hxxps://mx1.gnarquitectos.online/build.exe