MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 15

Intelligence 15 IOCs YARA 16 File information Comments

SHA256 hash:	0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a
SHA3-384 hash:	ff7b3c7004ff032da67617919ee2cdc6ccadd15173e38400da93999d48edd007acacc942934930e00677809113e01955
SHA1 hash:	7a3a0a73f31c00e6deeb5d6cf5b6b64d168ea5a1
MD5 hash:	c8d9ad858a92f86cd38987377c70f02e
humanhash:	butter-four-jupiter-skylark
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	207'872 bytes
First seen:	2026-01-19 16:21:02 UTC
Last seen:	2026-01-19 19:45:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ee53c10aff1d01eafea53328179e33a2 (3 x Vidar)
ssdeep	6144:DfRqkCZLdOzYFBf/Mhi2nJm14R0yXryT2Zi95zV:DZsLwJig0ybyqZit
TLSH	T182141337F4690C89F1F722F2590C3E1B25212926DAB742DDCB69FE5C35AB165C94C2E0
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 UPX vidar

Bitsight

url: http://130.12.180.43/files/mrx/random.exe

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	207'872 bytes
File size (de-compressed) :	598'016 bytes
Format:	win64/pe
Unpacked file:	0318a89256b75a6fd0602afbb733a3c0a9bba80042668d18ef85125e13e4973f

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/86b9e706-0526-41d2-9cfb-77bfddd950ee/

Malware family:

vidar

ID:

File name:

_0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a.exe

Verdict:

Malicious activity

Analysis date:

2026-01-19 16:23:07 UTC

Tags:

stealer stealc vidar upx xor-url generic

Link:

https://app.any.run/tasks/838d33d0-1477-4a64-b942-b31ddf06c440

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49419/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=696e5a0dbcad3327ec067a91

Tags:

ransomware obfuscated small

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug fingerprint obfuscated packed packed packed upx vidar

Link:

https://www.filescan.io/uploads/696e5a0955805a763fe8f519/reports/0f20925d-84cf-44f7-b6ca-5f80fcc4a283/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a

Result

Gathering data

Verdict:

Malicious

File Type:

exe x64

Detections:

Trojan-PSW.Win32.Vidar.d

Link:

https://opentip.kaspersky.com/0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4fe36d21-a314-462d-a640-3561d07a6c60

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/c8d9ad858a92f86cd38987377c70f02e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b26np74shck3qktmcrmdc5r6h7fb7mjbesmflqu4ti7rmmy5igfa._file

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar stealer upx

Link:

https://tria.ge/reports/260119-ttw3yagw6b/

Behaviour

UPX packed file

Detects Vidar Stealer

Vidar

Vidar family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/af10a3c5-504f-441b-a3f2-b38cab00fbc2

Unpacked files

SH256 hash:

0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a

MD5 hash:

c8d9ad858a92f86cd38987377c70f02e

SHA1 hash:

7a3a0a73f31c00e6deeb5d6cf5b6b64d168ea5a1

Link:

https://www.unpac.me/results/e8f44121-8ca9-4209-9983-df81e0e9bfc5/

SH256 hash:

0318a89256b75a6fd0602afbb733a3c0a9bba80042668d18ef85125e13e4973f

MD5 hash:

1942e8f698c4c3951b326f5fd1889064

SHA1 hash:

863721cd70ff8ca516b900803f0c168d3be53bd1

Detections:

SUSP_XORed_URL_In_EXE

SUSP_XORed_Mozilla

Link:

https://www.unpac.me/results/e8f44121-8ca9-4209-9983-df81e0e9bfc5/

Parent samples :

0318a89256b75a6fd0602afbb733a3c0a9bba80042668d18ef85125e13e4973f
0ebcd7ff923895b82a6c145831763e3fca1fb121249855c29c9a3f16331d418a

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0ebcd7ff9238/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)