MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2
SHA3-384 hash:	794663f949d0ddbe0742f93e406ab40eea733fbc5fb99591d4b747888fab47c265b203f1c070d8393f7613fc553a9dff
SHA1 hash:	4da01c4decc401a3eb3f8f403d247a087971044c
MD5 hash:	9fb1e8283034a17f8732565023e48b58
humanhash:	stairway-mango-cardinal-march
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	374'821 bytes
First seen:	2026-10-19 18:20:38 UTC
Last seen:	2026-10-22 16:11:23 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	6ed4f5f04d62b18d96b26d6db7c18840 (1'004 x SalatStealer, 78 x BitRAT, 49 x Vidar)
ssdeep	6144:auOWxB9v6UyqA+8rAQzlvYAHkocLN83GfokCfn5+bHNzJdISjJtyAJ/G:aupv6Uyqr8DziASLiGfu+LNzJjDyAJ/G
TLSH	T10F841242410B6EADDEBDD6734B9A8389272D673C3ACBC73955ADC25D3354E02CEC1868
TrID	61.0% (.EXE) UPX compressed Win64 Executable (70117/5/12) 23.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 5.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.7% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-Vidar exe f7e0bdc53604a00d861131d2693a943c UPX

Bitsight

url: http://62.60.226.140/files/gold/file.exe

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	374'821 bytes
File size (de-compressed) :	1'394'213 bytes
Format:	win64/pe
Unpacked file:	379a2944024fe73ff4af0d02eeb4764918f3009aa236207e0edd616cbfb84ccc

Intelligence

File Origin

# of uploads :

2'506

# of downloads :

258

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/983fce8e-c6d8-4815-9bca-184ffe197a22/

Malware family:

xmrig

ID:

File name:

2to1ep.exe

Verdict:

Malicious activity

Analysis date:

2026-10-19 18:26:14 UTC

Tags:

auto metasploit framework github stealer stealc xmrig miner generic rustystealer loader babadeda crypter python opendir lumma possible-phishing solarisloader venom rat remcos formbook phorpiex botnet silentnet powershell evasion dcagentrmm pyinstaller telegram svc purelogs remusstealer solaris donutloader pastebin advancedinstaller arcticagent asyncrat ip-check phishing nemucod eclipse clickfix glamour adware datto rmm-tool payload vidar cobaltstrike tool coinminer xworm susp-powershell emmenhtal delphi reversessh action1 screenconnect rdp openssl pikabot abyssos remote

Link:

https://app.any.run/tasks/79c3c25f-f264-4ee3-89b0-712f874e5541

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92936/

Detection(s):

SecuriteInfo.com.FileRepMalware.27152444.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad65fa45a22ac805bd7f4be

Tags:

virus

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Launching a service

Behavior that indicates a threat

Sending an HTTP GET request

Gathering data

Verdict:

Malicious

Labled as:

Vidar.Generic

Link:

https://www.hybrid-analysis.com/sample/0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-19T16:21:00Z UTC

Last seen:

2026-10-21T09:30:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1f0f4f25-4c73-41b4-a4eb-6c613291f6ad

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/9fb1e8283034a17f8732565023e48b58

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2/

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-10-19 18:21:29 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bwhrouuddtkf7p3oi6dm7v7dngl2xgbv57opw6kqwhnvfzm7mpza._file

Verdict:

malicious

Label(s):

Vidar

Link:

https://reports.threatray.com/a5676f20-e2c1-4fe5-90a0-a93411ca68cd

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery upx

Link:

https://tria.ge/reports/261019-wzgxbaez4s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Reads the TCP/IP host and domain name from the registry

UPX packed file

Unpacked files

SH256 hash:

0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2

MD5 hash:

9fb1e8283034a17f8732565023e48b58

SHA1 hash:

4da01c4decc401a3eb3f8f403d247a087971044c

Detections:

SUSP_Imphash_Mar23_3

Link:

https://www.unpac.me/results/c7ddecfc-0163-44a5-a5b1-b429443c61db/

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0d8f1752831c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.22

Link:

https://yomi.yoroi.company/submissions/0d8f1752831cd45fbf6e4786cfd7e36997ab9835efdcfb7950b1db52e59f63f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	SUSPICIOUS_Potential_DDR Create hunting rule
Author:	NyxIndius
Description:	Detects PE files referencing web services potentially used as dead drop resolvers, with network capability correlation for single-indicator cases

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.