MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25aacccb984253d31e2612f2081c0a5f27182474a29ffe6cb03d2386ee4ce8c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	25aacccb984253d31e2612f2081c0a5f27182474a29ffe6cb03d2386ee4ce8c6
SHA3-384 hash:	a8d9159604c94fdeae2c12b401394c41859cc9173128f5582fc2a539796940337349989f597112c4ed1b4b8526610b92
SHA1 hash:	93f5cb4fce1ba897c89f93c35b9601828c8aeb4a
MD5 hash:	a836bb725b25ab5cd4805c8e1e94f66a
humanhash:	spring-network-saturn-one
File name:	ɢɪᴛнᴜʙ seᴛᴜр.bat
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	567 bytes
First seen:	2025-05-19 21:58:41 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	12:w7Rf6R0t87kZAt2rHR9IbEOONsyIVO98JGz5lX6p5MujTj/39JOwa0:w7RfTJZAt2DR9lOOSk7z55tQtvZ
TLSH	T12DF0813F504970550B7D8720CA185486F4094BCF5995DA5774A0F59DBF752012AEECCD
Magika	batch
Reporter	aachum
Tags:	bat vidar

iamaachum

https://outmertupw.xyz/SPy2KC?store=MATLAB&src= => https://www.mediafire.com/file/rswbaet2iwdk8s4/%C9%A2%C9%AA%E1%B4%9B%D0%BD%E1%B4%9C%CA%99+se%E1%B4%9B%E1%B4%9C%D1%80.bat/file

Vidar C2: https://d3.7.4t.com/

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

171

Origin country :

ES

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

ɢɪᴛнᴜʙ seᴛᴜр.bat

Verdict:

Malicious activity

Analysis date:

2025-05-19 22:00:29 UTC

Tags:

loader

Link:

https://app.any.run/tasks/381e439d-6fec-4c4d-a351-317f7df081b5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Heur.BZC.MNT.Boxter.928.38BCA524.19511.735.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682ba9b5c28c67d666421fa0

Tags:

vmdetect shell virus sage

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Running batch commands

Launching a process

Сreating synchronization primitives

Connection attempt

Sending an HTTP GET request

Creating a file

Creating a process from a recently created file

Creating a window

Creating a process with a hidden window

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

cmd dropper fingerprint installer lolbin opendir opendir overlay packed powershell

Link:

https://www.filescan.io/uploads/682ba9b6bff72ff46b6674c5/reports/90172977-3bd8-41d6-9ff9-8205d59a17b0/overview

Joe Sandbox Vidar

Result

Threat name:

Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1694374

Signature

.NET source code contains process injector

.NET source code references suspicious native API functions

Compiles code for process injection (via .Net compiler)

Creates a thread in another existing process (thread injection)

Encrypted powershell cmdline option found

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Powershell drops PE file

Searches for specific processes (likely to inject)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious Invoke-WebRequest Execution

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Powershell decode and execute

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/25aacccb984253d31e2612f2081c0a5f27182474a29ffe6cb03d2386ee4ce8c6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/25aacccb984253d31e2612f2081c0a5f27182474a29ffe6cb03d2386ee4ce8c6/

ReversingLabs TitaniumCloud Script-BAT.Packed.Boxter

Threat name:

Script-BAT.Packed.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-19 21:59:13 UTC

File Type:

Text (Batch)

AV detection:

9 of 24 (37.50%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ewvmzs4yijj5ghrgclzaqhakl4trqjduukp743fqhuryn3sm5dda._file

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar credential_access defense_evasion discovery execution spyware stealer

Link:

https://tria.ge/reports/250519-1v56kazpz5/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Executes dropped EXE

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Uses browser remote debugging

Detect Vidar Stealer

Vidar

Vidar family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/25aacccb984253d31e2612f2081c0a5f27182474a29ffe6cb03d2386ee4ce8c6