MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 12

Intelligence 12 IOCs YARA 15 File information Comments

SHA256 hash:	ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1
SHA3-384 hash:	f88a7633d4ff2b910e511c7c73ce4b0c9521c49dcd48947af9f342f1d7540b5ff742b310904e102bb80583f283fc3b77
SHA1 hash:	7232cc01e00651cee7e52e2952671b3c6b3841aa
MD5 hash:	f250e58c11cb96187f9772fab5600144
humanhash:	oregon-seven-blue-triple
File name:	f250e58c11cb96187f9772fab5600144.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	268'288 bytes
First seen:	2023-11-27 15:13:42 UTC
Last seen:	2023-11-27 17:17:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9bcd508567ec94e2b89a6c2619b9256e (2 x Smoke Loader, 1 x Stealc, 1 x MarsStealer)
ssdeep	6144:lLsXRQ2rfug5WfAly+yDjO7cVgSWw4XA6cKRP:lLoPug4fAvyDLfWwSTh
TLSH	T10744AF2363E19831F6238A31CE2AC7E4662FB8514F656ADB53645AFF1D702F1C6B6301
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0421392404231101 (1 x Vidar)
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/460709/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Steam.36842.29426.23781.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a file

Reading critical registry keys

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control greyware lolbin packed xpack

Link:

https://www.filescan.io/uploads/6564b23f380413dc0c23566f/reports/cb45220c-9f3e-4372-803a-ca40dc3d392f/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3b6e9a63-f188-47bb-b223-f623bb9e0c88

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1348650

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2023-11-27 15:08:35 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 23 (91.30%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5sin54gaxlnvjbamx4p23y5hanm2wxefmgni6ryql2hrtip4qxqq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/231127-smbb8ahd3z/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks installed software on the system

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Downloads MZ/PE file

Unpacked files

SH256 hash:

4a0c1cb0a43b2f2cbf20f5040b344d00fb22bfddedef864378fcea3f3d609d6c

MD5 hash:

abf5bf55d9eaeb234eabfff6cc8a9a75

SHA1 hash:

1fa16b955d45071376fb487be54e099d9a983a70

Link:

https://www.unpac.me/results/6b9d12e1-664d-4ef7-9082-2ff62773d28b/

SH256 hash:

ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1

MD5 hash:

f250e58c11cb96187f9772fab5600144

SHA1 hash:

7232cc01e00651cee7e52e2952671b3c6b3841aa

Link:

https://www.unpac.me/results/6b9d12e1-664d-4ef7-9082-2ff62773d28b/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ec90def0c0ba/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ec90def0c0badb54840cbf1fade3a70359ab5c85619a8f47105e8f19a1fc85e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_vidar Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detection of Vidar Stealer and Variants via strings present in final unpacked payloads

Rule name:	win_vidar_strings_jun_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detection of Vidar Stealer and Variants via strings present in final unpacked payloads