MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71
SHA3-384 hash:	ca244e494ce77f8f2a3b01e66794eabec3b4893e8a5da4be1bcc1f40addd3c346de5e4cef5fb2b2146d295b76d3bad00
SHA1 hash:	71db7a8f1bb2a5cbebd279f98ba8d6a34e9a3226
MD5 hash:	544482f7cc6c2368f454d66950bcc623
humanhash:	nineteen-johnny-juliet-echo
File name:	17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71
Download:	download sample
Signature	Vidar Create hunting rule
File size:	14'336 bytes
First seen:	2026-08-10 14:25:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	258d7cca1a45fc76d070b638c4790e6b (1 x Vidar)
ssdeep	192:OjhXcb6jS/puejOZSi7YMTvcxflOksV4WUw5reCw6CG69fZmDVvTRtTt4D8M7mtG:Oj3D4uksiWUsqCw6CG6+Vt4gMZa9l
TLSH	T1BE520A86B0C330F9C43AC379D74653A3DAB6707812394BFF6BDDA5691E619103EA8748
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

almost there.zip

Verdict:

Malicious activity

Analysis date:

2026-07-15 04:33:02 UTC

Tags:

auto generic metasploit framework opendir evasion loader phishing maskgramstealer python solaris github phorpiex botnet massbass ipfs remusstealer powershell asyncrat rat rustystealer stealer possible-phishing nemucod clickfix stealerium quasar koiloader coinminer miner action1rmm meterpreter njrat discordrat glamour rhadamanthys bruteratel cobaltstrike tool telegram networm amus havoc maskgram arch-scr guloader redline whitesnakestealer smb donutloader purehvnc gh0st xworm purelogs qrcode putty rmm-tool vidar tinynuke pushware adware discord remcos cryptowall ransomware wannacry infinitycrypt scan smbscan datto jigsaw pyinstaller ip-check bladabindi amadey noescape wiper neshta stealc ammy cryptolocker emotet websocket smoke pastebin whitesnake autohotkey lumma formbook screenconnect exfiltration azorult jeefo seetrol remote remus salatstealer acr qatarrat advancedinstaller tor susp-powershell netsupport hijackloader redosdru delphi api-base64 dcrat

Link:

https://app.any.run/tasks/607e95d9-fb17-4001-b1d5-fd913c8a87bc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/79865/

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Creating a file

Deleting a recently created file

Searching for synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

microsoft_visual_cc

Link:

https://www.filescan.io/uploads/6a79df9e69834dc68069546c/reports/9a8d0c54-6f6d-423e-a1ce-30c43782e50f/overview

Verdict:

Malicious

Labled as:

Vidar.Generic

Link:

https://www.hybrid-analysis.com/sample/17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-15T04:52:00Z UTC

Last seen:

2026-07-30T08:53:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d3095373-899e-4bba-8ceb-3dadfe916673

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71/

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-07-15 11:01:30 UTC

File Type:

PE+ (Exe)

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=c7clq3cx6tuna3em2lgfk4xtif44obcueematmxuidimaxwnp5yq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260810-rr641sgg67/

Unpacked files

SH256 hash:

17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71

MD5 hash:

544482f7cc6c2368f454d66950bcc623

SHA1 hash:

71db7a8f1bb2a5cbebd279f98ba8d6a34e9a3226

Link:

https://www.unpac.me/results/bebc8cfa-28ca-41e0-821b-d98f99a2d89d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.