analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63

Full analysis: https://app.any.run/tasks/499f18d1-148a-4e1f-88e0-3638ab2d6f5a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 20, 2019, 07:27:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
evasion
stealer
vidar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B7B89841F9126453B98ED05012475239

SHA1:

D0FBB78AD25F8B39CC8C273078600D06E3A12CA6

SHA256:

9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63

SSDEEP:

12288:ALHNpMOGPWN85IUla+KvaUG10k62EgSX02b2KC9G7+jyuo:+gOGON85IUlaI6QSXviVWuo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Downloads executable files from the Internet

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Actions looks like stealing of personal data

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Stealing of credential data

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • VIDAR was detected

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
  • SUSPICIOUS

    • Creates files in the program directory

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Executable content was dropped or overwritten

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Creates files in the user directory

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Changes tracing settings of the file or console

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Reads the cookies of Mozilla Firefox

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Reads the cookies of Google Chrome

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Checks for external IP

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2572)
    • Starts CMD.EXE for commands execution

      • 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe (PID: 3600)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:05:24 21:12:05+02:00
PEType: PE32
LinkerVersion: 9
CodeSize: 261632
InitializedDataSize: 5760000
UninitializedDataSize: -
EntryPoint: 0x8c0e
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.5.1
ProductVersionNumber: 1.1.0.1
FileFlagsMask: 0x006f
FileFlags: Pre-release, Patched
FileOS: Unknown (0x40304)
ObjectFileType: Static library
FileSubtype: 81
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.5.4
InternalName: vyuyfuyk.exu
LegalCopyright: Copyright (C) 2019, ghjrfkh

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-May-2018 19:12:05
Detected languages:
  • Chinese - PRC
FileVersion: 1.0.5.4
InternalName: vyuyfuyk.exu
LegalCopyright: Copyright (C) 2019, ghjrfkh

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 24-May-2018 19:12:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0003FD9D
0x0003FE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.82082
.rdata
0x00041000
0x00006D48
0x00006E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.5667
.data
0x00048000
0x004DBF48
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.80325
.idata
0x00524000
0x00001E12
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.55243
.ttt
0x00526000
0x0008AAFE
0x0008AC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.58047
.rsrc
0x005B1000
0x00009350
0x00009400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.98065
.reloc
0x005BB000
0x0000606A
0x00006200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
3.01038

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.42775
420
UNKNOWN
UNKNOWN
RT_VERSION
2
6.32578
2216
UNKNOWN
UNKNOWN
RT_ICON
3
6.07087
1736
UNKNOWN
UNKNOWN
RT_ICON
4
5.84777
1384
UNKNOWN
UNKNOWN
RT_ICON
5
5.25075
9640
UNKNOWN
UNKNOWN
RT_ICON
6
5.34942
2440
UNKNOWN
UNKNOWN
RT_ICON
11
3.25502
2270
UNKNOWN
UNKNOWN
RT_STRING
12
3.28939
1560
UNKNOWN
UNKNOWN
RT_STRING
13
3.26965
1890
UNKNOWN
UNKNOWN
RT_STRING
14
3.22667
468
UNKNOWN
UNKNOWN
RT_STRING

Imports

GDI32.dll
KERNEL32.dll
MSIMG32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #VIDAR 9518a4039c63c3a02f4dfadffb367c8608c825091ac0f9a1707c40b555922a63.exe cmd.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3600"C:\Users\admin\AppData\Local\Temp\9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe" C:\Users\admin\AppData\Local\Temp\9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2572"C:\Windows\System32\cmd.exe" /c taskkill /im 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe /f & erase C:\Users\admin\AppData\Local\Temp\9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe & exitC:\Windows\System32\cmd.exe9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2388taskkill /im 9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe /f C:\Windows\system32\taskkill.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
83
Read events
65
Write events
0
Delete events
0

Modification events

No data
Executable files
12
Suspicious files
1
Text files
12
Unknown types
5

Dropped files

PID
Process
Filename
Type
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\c-shm
MD5:
SHA256:
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\history
MD5:
SHA256:
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\history-shm
MD5:
SHA256:
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\145[1].txttext
MD5:A0780003B580AE4D2DDB2569D0717450
SHA256:422C06FB3FE621EC5C4CF6E4137DAA4B017C98B660F987C1AA1BDD3D15B1682B
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\files\History\history_Mozilla Firefox_qldyz51w.default.txttext
MD5:C1C75A919B09BAF96AAFB3EF602F1F3E
SHA256:E722E82A2500A48A85756BA9B8E025B096A4137431C5AB41ABD9C6BFDB7CDD7E
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\files\passwords.txttext
MD5:AB5014605C2B83465EC4F1F4195F4DAE
SHA256:81A996659BA2C1B261FEF53D36217F30C229173BC0B91DFD4C06FC086590075D
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\csqlite
MD5:DD9640AF5F03807CF2E3921CBA16AF0D
SHA256:ECF72C454FEF08C5948A565464839A554567E499F995483D6C8B54B32EA2C5F0
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\historychsqlite
MD5:9D0A95819E97B7AA666D2F1E1DC4A6C5
SHA256:B67B09717E75A9E5DC9F7DC4BB9C05069909CAB47D9B12A2707D19FF7F6E8CB9
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\files\History\Google Chrome_Default.txttext
MD5:A251F59797A931F24E4C97B90C3382C5
SHA256:8A9207583EE1E39541A302BF0647B0E0E4FE5B0173E041CC06DF9C72A3CC5DDC
36009518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exeC:\ProgramData\I0QO2OUKDI0JPLVF8N34NAZFL\ldsqlite
MD5:7ED7E7FFE1DC4EAAEE2EDAFDD4815A47
SHA256:BD7D82BAB01903699A91783F35D7E1EBF2BA8AEDC1023F09C0E6934B1B0651C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
11
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
301
18.205.93.2:80
http://bitbucket.org/scat01/1/downloads/scat01_2019-05-20_06-13.exe
US
shared
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
301
18.205.93.2:80
http://bitbucket.org/scat01/1/downloads/service.exe
US
shared
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
POST
200
199.19.225.196:80
http://bestpolandhotels.com/
US
text
94 b
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
POST
200
185.194.141.58:80
http://ip-api.com/line/
DE
text
180 b
shared
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
POST
200
199.19.225.196:80
http://bestpolandhotels.com/145
US
text
148 b
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
200
199.19.225.196:80
http://bestpolandhotels.com/mozglue.dll
US
executable
133 Kb
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
200
199.19.225.196:80
http://bestpolandhotels.com/vcruntime140.dll
US
executable
81.8 Kb
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
200
199.19.225.196:80
http://bestpolandhotels.com/softokn3.dll
US
executable
141 Kb
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
200
199.19.225.196:80
http://bestpolandhotels.com/freebl3.dll
US
executable
326 Kb
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
GET
200
199.19.225.196:80
http://bestpolandhotels.com/msvcp140.dll
US
executable
429 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
185.194.141.58:80
ip-api.com
netcup GmbH
DE
unknown
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
18.205.93.2:80
bitbucket.org
US
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
18.205.93.2:443
bitbucket.org
US
malicious
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
199.19.225.196:80
bestpolandhotels.com
FranTech Solutions
US
malicious

DNS requests

Domain
IP
Reputation
bestpolandhotels.com
  • 199.19.225.196
malicious
ip-api.com
  • 185.194.141.58
shared
bitbucket.org
  • 18.205.93.2
  • 18.205.93.1
  • 18.205.93.0
shared

Threats

PID
Process
Class
Message
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
A Network Trojan was detected
ET TROJAN Vidar/Arkei Stealer Client Data Upload
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
A Network Trojan was detected
MALWARE [PTsecurity] Generic Stealers activity (Nocturnal/Vidar)
3600
9518A4039C63C3A02F4DFADFFB367C8608C825091AC0F9A1707C40B555922A63.exe
A Network Trojan was detected
MALWARE [PTsecurity] Stealer.Vidar
3 ETPRO signatures available at the full report
No debug info