MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 12

Intelligence 12 IOCs YARA 7 File information Comments

SHA256 hash:	e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6
SHA3-384 hash:	82d77222a20d5e9a87335566c20971c66f90015d3d4672f80040fba8ddcef4d76abe30f71456914b838187bdaab6d153
SHA1 hash:	55ee487fe46e4a15744d44a5422e149a7afb1265
MD5 hash:	7f8fc19d84a03ba3446cb151a41a813c
humanhash:	magazine-purple-social-east
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	1'797'856 bytes
First seen:	2023-10-22 01:24:22 UTC
Last seen:	2023-10-22 23:39:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8a73a83fdced3fd9c55fbc1b70e551ad (6 x CoinMiner, 3 x Vidar)
ssdeep	24576:IegXZg/t6PuVzXU0pZABoMj6ZHHy1PoAboHXwM:GXZg16uEgltOLUHXB
Threatray	3 similar samples on MalwareBazaar
TLSH	T18B858C09F39405E8D85BC730CA1ADF32D7B4B45A0722DBAB1B66C6871E73AD05F3A611
TrID	83.7% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 7.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 4.4% (.EXE) Win64 Executable (generic) (10523/12/4) 2.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.8% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	andretavare5
Tags:	exe signed vidar

Code Signing Certificate

Organisation:	Microsoft Code Signing PCA 2011
Issuer:	Microsoft Code Signing PCA 2011
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-10-22T00:55:45Z
Valid to:	2024-10-22T00:55:45Z
Serial number:	06faa9deb8d4b7a36856ba63d085cbca
Thumbprint Algorithm:	SHA256
Thumbprint:	5d058560e5f57a5fc10c154f119d080214c2d2c1921069407354d60926bca521
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

andretavare5

Sample downloaded from http://171.22.28.221/files/Ads.exe

Intelligence

File Origin

# of uploads :

# of downloads :

324

Origin country :

Vendor Threat Intelligence

Malware family:

arkei

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-10-22 01:27:01 UTC

Tags:

opendir loader stealer arkei vidar

Link:

https://app.any.run/tasks/3385a3c4-24d9-4e12-9d3d-67aa1b389770

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win64.PWSX-gen.7074.25554.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file in the %temp% directory

Creating a window

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Searching for synchronization primitives

Running batch commands

Launching cmd.exe command interpreter

Forced shutdown of a system process

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a recently created process

Unauthorized injection to a system process

Sending an HTTP GET request to an infection source

Enabling autorun by creating a file

Adding an exclusion to Microsoft Defender

Gathering data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

hacktool overlay packed

Link:

https://www.filescan.io/uploads/653479f0c2a76fbfed30dc15/reports/99edc6cf-526a-42db-9df8-5a63b8f821c7/overview

Verdict:

Malicious

Labled as:

Win64/Kryptik.EBH trojan

Link:

https://www.hybrid-analysis.com/sample/e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e5be3f82-a8ad-4aad-9506-5cc049e03ec7

Score:

75%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6/

Threat name:

Win64.Trojan.Privateloader

Status:

Malicious

First seen:

2023-10-22 01:25:07 UTC

File Type:

PE+ (Exe)

AV detection:

12 of 23 (52.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5coyv5ratomvip6s3tekg6cc2qhe2vflr5jm4y2wmxcdfiks3dla._file

Verdict:

unknown

Vidar

85c7ebf244cb05f624baea0b1526c57ba3ecaa05583c27fe814217f9ffbf020c

Vidar

c8123964a14a24724ce73744c33bfac9446e53ca0675f37c68510284f8c9ee32

Vidar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:glupteba family:vidar botnet:af2b108237a470d5313ebab11ef5d055 dropper evasion loader stealer upx

Link:

https://tria.ge/reports/231022-bsy7sscg8s/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Drops startup file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Downloads MZ/PE file

Drops file in Drivers directory

Stops running service(s)

Glupteba

Glupteba payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561199563297648
https://t.me/twowheelfun

Unpacked files

SH256 hash:

e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6

MD5 hash:

7f8fc19d84a03ba3446cb151a41a813c

SHA1 hash:

55ee487fe46e4a15744d44a5422e149a7afb1265

Link:

https://www.unpac.me/results/e73a202c-f767-4eb7-bca4-3ded357584ed/

Malware family:

Vidar.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e89d8af6209b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.44

Link:

https://yomi.yoroi.company/submissions/e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dropped by

PrivateLoader

Delivery method

Distributed via drive-by

URLhaus

https://urlhaus.abuse.ch/url/2721934/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample