MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cfa40843d9e169e9df5d61ab7b6cc6db59a3237b8a3ca9a3fa047ef836d7453. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cfa40843d9e169e9df5d61ab7b6cc6db59a3237b8a3ca9a3fa047ef836d7453
SHA3-384 hash: a59c3f14d20ec92ef072eac4c3953345c0c61bedbbca3858e3efbb4a737429dcc8edff842f21ad71039e95f2e4edd575
SHA1 hash: aaa95d93a0a792db0411868121413e0cdc453373
MD5 hash: 91092ecc0a5a3866dea9fb5088e6ad74
humanhash: arkansas-alpha-idaho-zebra
File name:figural.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:83'917'595 bytes
First seen:2026-07-25 10:09:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (589 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep 1572864:bX2um44Hif/8w8jzzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyH:bXTm4vHOw9NYJo+sUifljLcs22/h
TLSH T1EB0833897F62E13FF427D4B3D11866E8619BF188E733CB57112E85DEE8B36106B441A2
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c4dadadad2f492c2 (148 x GuLoader, 51 x RemcosRAT, 23 x VIPKeylogger)
Reporter burger
Tags:exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b86c7716-fbfa-4864-a6c7-2abd02b3690a/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a window
Searching for the window
Searching for the Windows task manager window
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Forced system process termination
Searching for synchronization primitives
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context adaptive-context anti-debug crypto installer installer microsoft_visual_cc nsis packed reconnaissance
Link:
https://www.filescan.io/uploads/6a648b97099f3608e6812357/reports/9b43a2ab-95db-48a0-8162-6f43d195de88/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/1cfa40843d9e169e9df5d61ab7b6cc6db59a3237b8a3ca9a3fa047ef836d7453
Verdict:
Unknown
File Type:
exe x32
First seen:
2026-07-25T13:05:00Z UTC
Last seen:
2026-07-25T17:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1cfa40843d9e169e9df5d61ab7b6cc6db59a3237b8a3ca9a3fa047ef836d7453/results?tab=lookup
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1947900
Signature
Bypasses PowerShell execution policy
Drops large PE files
Encrypted powershell cmdline option found
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Suspicious Encoded PowerShell Command Line
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses WMIC command to query system information (often done to detect virtual machines)
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1947900 Sample: figural.exe Startdate: 25/07/2026 Architecture: WINDOWS Score: 100 107 ipinfo.io 2->107 109 ifconfig.me 2->109 111 2 other IPs or domains 2->111 125 Suricata IDS alerts for network traffic 2->125 127 Yara detected Vidar stealer 2->127 129 Joe Sandbox ML detected suspicious sample 2->129 131 Sigma detected: Suspicious Encoded PowerShell Command Line 2->131 13 Installer.exe 3 2->13         started        16 figural.exe 12 200 2->16         started        signatures3 process4 file5 153 Unusual module load detection (module proxying) 13->153 155 Uses WMIC command to query system information (often done to detect virtual machines) 13->155 19 cmd.exe 13->19         started        22 cmd.exe 1 13->22         started        24 cmd.exe 1 13->24         started        28 17 other processes 13->28 95 C:\Users\user\AppData\Local\...\Installer.exe, PE32+ 16->95 dropped 97 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 16->97 dropped 99 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 16->99 dropped 101 13 other files (none is malicious) 16->101 dropped 157 Drops large PE files 16->157 26 conhost.exe 16->26         started        signatures6 process7 dnsIp8 133 Encrypted powershell cmdline option found 19->133 31 powershell.exe 19->31         started        33 conhost.exe 19->33         started        135 Bypasses PowerShell execution policy 22->135 137 Uses WMIC command to query system information (often done to detect virtual machines) 22->137 35 conhost.exe 22->35         started        37 powershell.exe 19 24->37         started        40 conhost.exe 24->40         started        123 chrome.cloudflare-dns.com 162.159.61.3, 443, 49774, 49775 CLOUDFLARENET-CloudflareIncUS Canada 28->123 42 reg.exe 28->42         started        44 powershell.exe 28->44         started        46 powershell.exe 28->46         started        48 26 other processes 28->48 signatures9 process10 signatures11 50 Installer.exe 31->50         started        139 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 37->139 141 Loading BitLocker PowerShell Module 37->141 143 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 42->143 145 Tries to detect sandboxes / dynamic malware analysis system (registry check) 42->145 54 net1.exe 48->54         started        56 net1.exe 48->56         started        58 Conhost.exe 48->58         started        process12 dnsIp13 113 62.60.226.198, 49787, 80 FEMOITGB Germany 50->113 115 ifconfig.me 34.160.111.145, 443, 49786 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 50->115 117 3 other IPs or domains 50->117 103 C:\Users\user\AppData\...\payload.exe.tmp, PE32+ 50->103 dropped 105 C:\Users\user\AppData\...\payload.exe (copy), PE32+ 50->105 dropped 60 cmd.exe 50->60         started        63 cmd.exe 50->63         started        65 cmd.exe 50->65         started        67 20 other processes 50->67 file14 process15 dnsIp16 151 Uses cmd line tools excessively to alter registry or file data 60->151 70 reg.exe 60->70         started        73 conhost.exe 60->73         started        75 reg.exe 63->75         started        77 conhost.exe 63->77         started        85 2 other processes 65->85 119 172.64.41.3, 443, 49779, 49780 CLOUDFLARENET-CloudflareIncUS Canada 67->119 121 chrome.cloudflare-dns.com 67->121 79 powershell.exe 67->79         started        81 powershell.exe 67->81         started        83 powershell.exe 67->83         started        87 23 other processes 67->87 signatures17 process18 signatures19 147 Tries to detect sandboxes / dynamic malware analysis system (registry check) 70->147 149 Loading BitLocker PowerShell Module 79->149 89 Conhost.exe 85->89         started        91 net1.exe 87->91         started        process20 process21 93 Conhost.exe 91->93         started       
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1cfa40843d9e169e9df5d61ab7b6cc6db59a3237b8a3ca9a3fa047ef836d7453
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dt5ebbb5tylj5hpv2ynlpnwmnw2zumrxxcr4vgr7ubd67a3norjq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution trojan
Link:
https://tria.ge/reports/260725-l7x86avfqb/
Behaviour
Checks processor information in registry
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Hide Artifacts: Ignore Process Interrupts
Enumerates processes with tasklist
Executes a VBScript file via the Windows Script Host.
Checks installed software on the system
Hide Artifacts: Hidden Window
Looks up external IP address via web service
Obfuscated Files or Information: Command Obfuscation
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Command and Scripting Interpreter: PowerShell
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Windows security bypass
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments