MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 10 File information Comments

SHA256 hash:	285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66
SHA3-384 hash:	bf6d9550f3d8be9eacf2f2e780bbd99868a93f8fd5e70629daef0199df1b4fd7b063ccb3f3633beea3d42ac5feded606
SHA1 hash:	7c49d673cfcee301289870405358e511ad59bec8
MD5 hash:	f22f50d84666a2aedd3aace16eb1a4ff
humanhash:	papa-cat-enemy-missouri
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	462'848 bytes
First seen:	2025-12-23 12:07:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dc3120d7b4090566a887530f3c294893 (3 x Vidar)
ssdeep	6144:NwKZP9bhEeCdIR3VgJ/IAPkC1Iy2PJWA/clw+Tz3YlbTl7GW7Fqrsvg+sXaByspr:OKZPBhxVLCV2RcG+/CZ7VZBx+y
TLSH	T143A43BBE9C60E375F608C0BAD285D3635E2178010636BBA71DE9E7201545973EB1A3FE
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec vidar

abuse_ch

UPX decompressed file, sourced from SHA256 4412691fb97f2c13adc61b1b4bf4dd6e34d1e10cd8e1f65398921f3f9df569ac

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	171'008 bytes
File size (de-compressed) :	462'848 bytes
Format:	win64/pe
Packed file:	4412691fb97f2c13adc61b1b4bf4dd6e34d1e10cd8e1f65398921f3f9df569ac

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Vidar

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e9d8020f-d857-406a-80e5-97a009bc0b28/

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2025-12-23 12:10:15 UTC

Tags:

xor-url generic

Link:

https://app.any.run/tasks/2ee37bd8-3c7c-4272-976b-f75cdb925621

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/45847/

Detection(s):

Win.Malware.Malwarex-10058813-0

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=694a862f01c7b4a8fe54fb9a

Tags:

ransomware obfuscated dropper emotet

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug base64 crypto fingerprint hacktool obfuscated vidar

Link:

https://www.filescan.io/uploads/694a862d84afa5547b5cc3fb/reports/79b0a605-5949-4de9-9154-7d8570964845/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-23T09:19:00Z UTC

Last seen:

2025-12-24T23:28:00Z UTC

Hits:

~10

Detections:

Trojan-PSW.Win64.Coins.cwu

Link:

https://opentip.kaspersky.com/285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66/results?tab=lookup

Gathering data

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1838184

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject threads in other processes

Found malware configuration

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Tries to detect virtualization through RDTSC time measurements

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/f22f50d84666a2aedd3aace16eb1a4ff

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66/

Verdict:

Malicious

Threat:

Trojan-PSW.Win64.Coins

Link:

https://tip.neiki.dev/file/285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66

Threat name:

Win64.Spyware.Vidar

Status:

Suspicious

First seen:

2025-12-23 12:08:15 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fbnum2fycdulnjuhu6m2yrudkuoop3ko4eniyeecxuprzcpdxzta._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery spyware stealer trojan

Link:

https://tria.ge/reports/251223-pvfp5aymd1/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Time Discovery

Drops file in Windows directory

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dedda425-5ceb-465a-97da-161f449b9d9a

Unpacked files

SH256 hash:

285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66

MD5 hash:

f22f50d84666a2aedd3aace16eb1a4ff

SHA1 hash:

7c49d673cfcee301289870405358e511ad59bec8

Detections:

win_bazarbackdoor_auto

Link:

https://www.unpac.me/results/6aff19e7-054b-4c5d-bbfc-895f7ad8c1e7/

Parent samples :

285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66
4412691fb97f2c13adc61b1b4bf4dd6e34d1e10cd8e1f65398921f3f9df569ac

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/285b4668b810/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/285b4668b810e8b6a687a799ac4683551ce7ed4ee11a8c1082bd1f1c89e3be66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834