MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d1b365e4d62f35e3c52ec7e73dd08508be5865376c738d670a03eee64de6621. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0d1b365e4d62f35e3c52ec7e73dd08508be5865376c738d670a03eee64de6621
SHA3-384 hash:	4cd0e953fd44d254f5f3e269c9e56c2a5f58df25e88348c01ec06a0fe7b46d9d06f5993d95f1761e540b76a542a578e5
SHA1 hash:	b5277bed5ef2528ad3189a32f950fff864149843
MD5 hash:	f68a0dbbb1cc602050bd8c4fa0092928
humanhash:	yankee-artist-two-yellow
File name:	NexomiaUI_v7.87.38.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	95'060'360 bytes
First seen:	2026-09-25 18:45:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4f2f006e2ecf7172ad368f8289dc96c1 (184 x SalatStealer, 70 x Vidar, 46 x RemusStealer)
ssdeep	1572864:5v/hdYDZREbTyWuuu3SUvgAcOjCKw40HjexHDxdfJ+cbigJjkhoX5aOd8jwVBqGt:xhyG3yXzCGZciCZhQzHegJnz80umDS8
TLSH	T1BE28330B29A290ACC089AA78C5761712B6347D9CC73527DB2F50E3782E737C16DB9F64
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	KnownSpotter
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

229

Origin country :

CA

Vendor Threat Intelligence

ACCE SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/38a51d47-360a-4d4b-81e7-db17d010a583/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-25 18:53:37 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/05d4e441-8d3d-4817-8331-c599544c24fc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

DNS request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

bloated crypto golang overlay packed

Link:

https://www.filescan.io/uploads/6ab6c189f384e97f93d7c4f1/reports/22580e49-8491-4e7a-91e3-6d54c4aed4f9/overview

Hybrid Analysis WinGo/GenKryptik.HVAC trojan

Verdict:

Malicious

Labled as:

WinGo/GenKryptik.HVAC trojan

Link:

https://www.hybrid-analysis.com/sample/0d1b365e4d62f35e3c52ec7e73dd08508be5865376c738d670a03eee64de6621

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-25T19:48:00Z UTC

Last seen:

2026-09-26T22:07:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Stealerc.HTTP.C&C Trojan.Win64.Agent.smhlij Trojan.Win64.Agent.sb Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.TCP.C&C

Link:

https://opentip.kaspersky.com/0d1b365e4d62f35e3c52ec7e73dd08508be5865376c738d670a03eee64de6621/results?tab=lookup

Nucleon Malprob Susipicious

Score:

64%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/0d1b365e4d62f35e3c52ec7e73dd08508be5865376c738d670a03eee64de6621

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-25 18:53:30 UTC

File Type:

PE+ (Exe)

AV detection:

7 of 24 (29.17%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=buntmxsnmlzv4pcs5r7hhxiikcf6lbsto3dtrvtqua7o4zg6myqq._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/26178b14-3398-46be-bdd6-129d564ded9d

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar botnet:058ac4e8efa370004c9463e3b57ec0c6 defense_evasion discovery stealer

Link:

https://tria.ge/reports/260925-xex88sgh95/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Reads the TCP/IP host and domain name from the registry

Checks for VirtualBox DLLs, possible anti-VM trick

Checks system information in the registry

Checks BIOS information in registry

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Family: Vidar

Malware Config

C2 Extraction:

https://172.236.206.42
https://telegram.me/j88hor
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=64296247
https://steamcommunity.com/profiles/76561198633950250

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0d1b365e4d62/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.