MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049
SHA3-384 hash: ce629840ac5a9237ebb98f0fae6b2aca3a64844f5b284882260f8f71f145872d93a8d27e3ce8004ac046a370191d6ff1
SHA1 hash: 749cd84c573d0f529395b169d0a04c6ea2d9d474
MD5 hash: 57d80cba964862b95ffd978543b7ff3e
humanhash: bulldog-zebra-carolina-island
File name:4ff5fe4e66d8f65cdfc2a3b16720cdbd3f7908fc7d861b8810293703aa61c0be.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:1'357'312 bytes
First seen:2026-08-30 11:32:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:A5C/oLYXGgfcKf+fkX6VzeGQzwFrSOYB:x/RXSgpG0w8
TLSH T185551E8ED58213B5B393FB67A21AD6329DF6310580728635CF85AD359F02F24A02DEDD
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe upx-dec vidar


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 4ff5fe4e66d8f65cdfc2a3b16720cdbd3f7908fc7d861b8810293703aa61c0be
File size (compressed) :366'592 bytes
File size (de-compressed) :1'357'312 bytes
Format:win64/pe
Packed file: 4ff5fe4e66d8f65cdfc2a3b16720cdbd3f7908fc7d861b8810293703aa61c0be

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Vidar
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fdbcd2a5-50f6-49d3-999d-a5f4674f11f3/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-30 11:40:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bd05eab4-666e-42e3-bb9d-0c958f017137

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83314/
Detection(s):
SecuriteInfo.com.Variant.Lazy.733828.41234353.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6a9414fa4a023d5910b3e2dc/reports/48121419-6561-43fc-b1ab-8b9edfd4431b/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2a9b91be-afdf-443c-a532-98c112dec720
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1965859
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Monitors registry run keys for changes
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1965859 Sample: 4ff5fe4e66d8f65cdfc2a3b1672... Startdate: 30/08/2026 Architecture: WINDOWS Score: 100 59 zca.12naga.org 2->59 61 telegram.me 2->61 63 fg.microsoft.map.fastly.net 2->63 91 Suricata IDS alerts for network traffic 2->91 93 Multi AV Scanner detection for submitted file 2->93 95 Yara detected AntiVM3 2->95 97 2 other signatures 2->97 8 4ff5fe4e66d8f65cdfc2a3b16720cdbd3f7908fc7d861b8810293703aa61c0be.exe 35 18 2->8         started        12 msedge.exe 22 218 2->12         started        15 msedge.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 65 zca.12naga.org 172.67.202.117, 443, 49701, 49757 CLOUDFLARENET-CloudflareIncUS Canada 8->65 67 telegram.me 149.154.167.99, 443, 49698 TELEGRAMVG United Kingdom 8->67 101 Early bird code injection technique detected 8->101 103 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->103 105 Found many strings related to Crypto-Wallets (likely being stolen) 8->105 107 11 other signatures 8->107 19 msedge.exe 2 11 8->19         started        22 msedge.exe 8->22         started        24 msedge.exe 8->24         started        32 8 other processes 8->32 69 239.255.255.250 unknown ZZ 12->69 53 C:\Users\user\AppData\Local\...\Web Data, SQLite 12->53 dropped 55 C:\Users\user\AppData\Local\...\Login Data, SQLite 12->55 dropped 57 C:\Users\user\AppData\Local\...\History, SQLite 12->57 dropped 26 msedge.exe 12->26         started        34 4 other processes 12->34 30 msedge.exe 15->30         started        36 2 other processes 15->36 38 2 other processes 17->38 file6 signatures7 process8 dnsIp9 99 Monitors registry run keys for changes 19->99 40 msedge.exe 19->40         started        42 msedge.exe 22->42         started        44 msedge.exe 24->44         started        71 ln-0007.ln-msedge.net 150.171.22.17, 443, 49734, 49747 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 26->71 73 ax-0002.ax-msedge.net 150.171.27.11, 443, 49736, 49746 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 26->73 79 7 other IPs or domains 26->79 51 C:\Users\user\AppData\Local\...\Cookies, SQLite 26->51 dropped 75 150.171.73.13, 443, 49748, 49749 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 30->75 81 2 other IPs or domains 30->81 77 192.168.2.4, 138, 443, 49588 unknown unknown 32->77 46 chrome.exe 32->46         started        49 msedge.exe 32->49         started        83 3 other IPs or domains 38->83 file10 signatures11 process12 dnsIp13 85 www.google.com 142.251.152.119, 443, 49717, 49723 GOOGLE-GoogleLLCUS United States 46->85 87 mobile-gtalk.l.google.com 74.125.196.188, 49731, 5228 GOOGLE-GoogleLLCUS United States 46->87 89 android.l.google.com 46->89
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/57d80cba964862b95ffd978543b7ff3e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkfxbtwl6guzodgiwdzof6gqwkyt26yf4txbfszdz5inenqwmbeq._file
Verdict:
malicious
Label(s):
Vidar
Create hunting rule
Link:
https://reports.threatray.com/b58f6e5d-18e4-427d-9e64-a1e6c00509cb
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260830-nnzc8ack5t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049
MD5 hash:
57d80cba964862b95ffd978543b7ff3e
SHA1 hash:
749cd84c573d0f529395b169d0a04c6ea2d9d474
Link:
https://www.unpac.me/results/4167f5ac-1688-444f-81d2-6e3eec4609fc/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2a8b70cecbf1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 4ff5fe4e66d8f65cdfc2a3b16720cdbd3f7908fc7d861b8810293703aa61c0be

Vidar

Executable exe 2a8b70cecbf1a9970cc8b0f2e2f8d0b2b13d7b05e4ee12cb23cf50d236166049

(this sample)

  
Dropped by
SHA256 4ff5fe4e66d8f65cdfc2a3b16720cdbd3f7908fc7d861b8810293703aa61c0be
  
URLhaus
https://urlhaus.abuse.ch/url/3903903/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/83314/
  
Dropped by
MD5 455bbc94bc64ec2526c061460df8ee44

Comments