MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 13

Intelligence 13 IOCs YARA 10 File information Comments

SHA256 hash:	2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca
SHA3-384 hash:	32325de8117be5ef878e8506d3f3479fbcff72fd544fcf31b42140d3f2028f82f4e1652b52005c3de1b8d0a4955b1dde
SHA1 hash:	0072c06cf375c1beaf57c055716ff1f893731cfc
MD5 hash:	f3a01caba24ff65cdf1185d5eb98c41d
humanhash:	echo-lima-hot-orange
File name:	Setup.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	21'616'048 bytes
First seen:	2026-07-16 06:10:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	42708d2b55d92e075f1f192a462703f5 (1 x Vidar)
ssdeep	393216:1u0Goe7O6bUtTVueiGsatFtoxP2TEL8MzdI6YeHjcX/1S48ALIbjvq9v/gdOnehe:1u0COMUueRtFt4D8466YeYX/P8ALYjv0
Threatray	43 similar samples on MalwareBazaar
TLSH	T1AC27330BD96A187DDB3F93B5F6CB993D6F19F096115C987C6220CB721C3C921E099B0A
TrID	48.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 19.1% (.EXE) Win64 Executable (generic) (6522/11/2) 14.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.9% (.EXE) OS/2 Executable (generic) (2029/13) 5.8% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	0cdeb79b97949669 (2 x CoinMiner, 1 x Vidar)
Reporter	kejult
Tags:	dropper exe Stealc stealer vidar

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

vidar

ID:

File name:

https://workupload.com/file/HetbwjVFEZz

Verdict:

Malicious activity

Analysis date:

2026-07-16 06:06:12 UTC

Tags:

qrcode evasion stealer stealc vidar

Link:

https://app.any.run/tasks/95a135db-b4fc-4448-9897-4a75d8042aad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74860/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.51661.10034.6493.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5875e3b3055706bb55680b

Tags:

khalesi dropper virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto explorer installer-heuristic kpotstealer lolbin obfuscated overlay reconnaissance settingsynchost

Link:

https://www.filescan.io/uploads/6a5875de9b933b61f3b22e15/reports/9e90104d-1338-41a6-adba-e13598f05908/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-11T04:58:00Z UTC

Last seen:

2026-07-15T15:49:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Zonidel.sb Trojan.Win32.Khalesi.riqr Trojan-PSW.Stealerc.TCP.C&C Trojan.Win32.Alkhaser.d Trojan.Win32.AntiVM.g Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.HTTP.C&C Trojan-PSW.Lumma.TCP.C&C Trojan-Dropper.Win32.Injector.sb Trojan-Banker.Bandra.TCP.C&C Trojan.Win32.RokRat.sb Trojan.Win32.Khalesi.riqp

Link:

https://opentip.kaspersky.com/2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca/results?tab=lookup

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca

Gathering data

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-07-11 17:45:47 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fpneixvxgiwhxsklmnold6c3236whn4xvcuvdmch42o2iastu3fa._file

Verdict:

malicious

Label(s):

vidar

Vidar

5536939f5e284524a0ee5f1fe401ac92237e4fb013b8c5adfc5b84d3b6d95017

Vidar

7bce64f71e61af03a0cf9efc56e81c4113e6541f252c368603fa43974523081b

Vidar

c08d7b0a6a2c416b664182e5715c49ceb62efa0eea3181f684d308a7e1fa3bd1

Vidar

c97f1f67e5730c1cb688c7759f5189917c70566480eefa69e873c24cdaa65219

Vidar

e5f2a58d5213a42f53183a7828b7ff571f0c4e4e025b83fd0eae21c97acaeee9

Vidar

ed1565803c87371b03b576b6fcfb47ba3aeebdcfa07010f1c27ed9c91a70b074

Vidar

eede323c8bd0370140dd9be6fbb92c82cef64210171325352f3e96e7026d3bfe

Vidar

error

Vidar

+ 33 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

9/10

Tags:

credential_access defense_evasion discovery stealer trojan

Link:

https://tria.ge/reports/260716-gxc31shy7t/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks installed software on the system

Checks whether UAC is enabled

Identifies Wine through registry keys

Unsecured Credentials: Credentials In Files

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2bda445eb732/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2bda445eb7322c7bc94b635cb1f85bd6fd63b797a8a951b047e69da40253a6ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.