MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 18

Intelligence 18 IOCs YARA 9 File information Comments

SHA256 hash:	0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d
SHA3-384 hash:	12c4e26a24d79242586f9051b77083568b50471ad204a7a40485681df883d064fa67cbb31b2e4f2d0c614590cd9f60da
SHA1 hash:	dc7881f149bd0a47b358ef8e3d2172dad49d813b
MD5 hash:	fbb4aa754effd0207e23e40c9f1595c7
humanhash:	violet-charlie-fanta-saturn
File name:	YSdQm5F.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	1'353'216 bytes
First seen:	2025-12-17 17:27:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	51220a89f4ad4e89280e2af926c3793c (7 x Vidar)
ssdeep	24576:CjCP91Doyv6Vzku2zQMGk0RAQMJiqMx3kmP40+6XjPF1IadcelPTJ3jvrNhp2Uok:CjtxxyQM10ud2LA01X51dcelLJ3/p5ok
Threatray	312 similar samples on MalwareBazaar
TLSH	T1AA5506796550D259FE3880B940F6965EB130723286712BFB0160E263EE1B5F1DFC62EE
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec vidar

abuse_ch

UPX decompressed file, sourced from SHA256 94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	588'288 bytes
File size (de-compressed) :	1'353'216 bytes
Format:	win64/pe
Packed file:	94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Vidar

Details

Link:

https://research.acce.ciphertechsolutions.com/results/fdc3de44-a549-410f-89b5-d9829a430a73/

Malware family:

n/a

ID:

File name:

_0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d.exe

Verdict:

Malicious activity

Analysis date:

2025-12-17 17:30:33 UTC

Tags:

xor-url generic

Link:

https://app.any.run/tasks/5eef40a9-9b90-4b0a-8908-8a5badd173f0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/45335/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6942e82f4d2b81828c3b8622

Tags:

ransomware emotet virus remo

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug base64 crypto fingerprint hacktool mikey obfuscated vidar

Link:

https://www.filescan.io/uploads/6942e82da7163552ba01f0f0/reports/20eee458-81bc-46c9-ae55-62ec17d6bea4/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-12T13:53:00Z UTC

Last seen:

2025-12-18T01:02:00Z UTC

Hits:

~10

Detections:

Trojan-PSW.Win32.Vidar.evi

Link:

https://opentip.kaspersky.com/0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/a0e911df-b473-4028-a74d-6a0692d1d429

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1835021

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject threads in other processes

Found API chain indicative of debugger detection

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/fbb4aa754effd0207e23e40c9f1595c7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d/

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Vidar

Link:

https://tip.neiki.dev/file/0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2025-12-12 20:03:14 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bqjdnepvr5lhuyxlcibkfbpapp3dlicaugzvij2drqf455eruigq._file

Verdict:

malicious

Label(s):

vidar

Vidar

68aa05a7b1b326f6fafac38621260c95d36807a8cc6ed96634739d86f99b0acd

Vidar

9647a6c4fbb3949b43f5c4a54bd002d49114cc7fe5628f3ad19bc0f5b46053ec

Vidar

ee08d090dd8e344c7745201232b1020dd7e2873896b2fc32374c3bd75d887a4d

Vidar

error

Vidar

f69936cb3fe33041ba7515ca5e1ca3be189eb4563ae7a9921f6b52e745761615

Vidar

fb64b596a9704845502f7eea9714c25b5658c6c2d77084a7f6a8d20d5db72c12

Vidar

+ 302 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/251217-v14a9sb17a/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Drops file in Windows directory

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3f3c80b7-13ba-4dec-a8a6-295b00c64086

Unpacked files

SH256 hash:

0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

MD5 hash:

fbb4aa754effd0207e23e40c9f1595c7

SHA1 hash:

dc7881f149bd0a47b358ef8e3d2172dad49d813b

Detections:

SUSP_XORed_URL_In_EXE

SUSP_XORed_Mozilla

Link:

https://www.unpac.me/results/96092e4b-0eaf-40bd-a9ef-79ec84394221/

Parent samples :

94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8
0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0c123691f58f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834