MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24
SHA3-384 hash: 8b73e27d266b03b8f0a8813a9e2525df6985e5bfae1504d06706025c8c7b2c95dc7fdaeb080e952cb561993895cf2a1d
SHA1 hash: f2fdcbb5f27d267382756540968e3e2d408b9496
MD5 hash: 00285e5b5015446bf2f5ae3db5216328
humanhash: robin-massachusetts-lamp-comet
File name:file
Download: download sample
File size:14'533'120 bytes
First seen:2023-06-30 16:20:16 UTC
Last seen:2023-06-30 16:56:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 57c9b357ae0cb2f414b0a5873e2f216d
ssdeep 98304:RB5kmoJMGpRYtwSc3MpxEX/4XFLaUFsYy3:RLkhJ5pRlBMgAXFM
Threatray 214 similar samples on MalwareBazaar
TLSH T10DE64A07F89191E5C0BED170CA369262FA303C485F3167D73A64FAB92B32BD85A79354
gimphash e074650018b36419f7a5f82bed4a7769538d874ee5005e9997bb60289260b65c
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter jstrosch
Tags:exe X64

Intelligence

File Origin
# of uploads :
2
# of downloads :
235
Origin country :
US US
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
https://www.mediafire.com/file/5b3epa2wiichnj1/v2.8_2023.rar/file
Verdict:
Malicious activity
Analysis date:
2023-06-29 22:49:15 UTC
Tags:
stealer vidar trojan loader
Link:
https://app.any.run/tasks/ffddcab6-306e-4df3-a840-7d2cd385dc59

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Tedy.384161.15821.26368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Reading critical registry keys
Running batch commands
Launching a process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug greyware
Link:
https://www.filescan.io/uploads/649f00f12299d268826397b1/reports/3084817d-18f1-4150-9f14-edcc71de88ed/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24
Result
Verdict:
MALICIOUS
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/03af6c80-4843-4318-80f3-afecad10cf22
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1264060
Signature
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 897087 Sample: file.exe Startdate: 30/06/2023 Architecture: WINDOWS Score: 52 16 Multi AV Scanner detection for submitted file 2->16 7 file.exe 2->7         started        process3 signatures4 18 Tries to harvest and steal browser information (history, passwords, etc) 7->18 10 cmd.exe 1 7->10         started        process5 process6 12 conhost.exe 10->12         started        14 choice.exe 1 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24/
Threat name:
Win64.Spyware.Raccoonstealer
Create hunting rule
Status:
Malicious
First seen:
2023-06-25 00:58:59 UTC
File Type:
PE+ (Exe)
AV detection:
24 of 37 (64.86%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7njnatjxo2xgaftf2muvcjmn6z2drbxz2fu3ur5hntqmn2len4sa._file
Verdict:
malicious
Similar samples:
090c5cbe4133ef686f2c8ad8cc1a835d1be38162a3add01fd4b0a53c5ea8cc85
37f4de4ac5d64d68e8c468d06ccc1cee1142894dbd87e63a6a53a3098db6e747
3d9ffc27500e20102800e24fb92fda87c6228bd2cacc9a9c660442c84fa0ce18
59f6e559d4053e7b5358708d5c6ac677889ba5702ef8e71fb64bd11494cf5c58
621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a
68ec885eabd2ac076ea588d4cf827eaa83e518d5a4c0578ee73bf0daa4ef9b67
6ee6ee45d3ece9254facb6b715189ea03ede981438929fc56f77e691681a66a1
7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17
c0bdd07daeb73c3739f70f84b9ed6dda1c45c305ac3c9edb152c2ac07286a517
c770b3a12fd153340bc59a93c422e133edffbc36f176aaf989311dea77e833d3
+ 204 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230630-ttm52adh25/
Behaviour
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24
MD5 hash:
00285e5b5015446bf2f5ae3db5216328
SHA1 hash:
f2fdcbb5f27d267382756540968e3e2d408b9496
Link:
https://www.unpac.me/results/0d53863d-40b1-4baa-bfc3-d828cdcde451/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2626800/

Comments