🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f4df752b979c6c1784add5410ea5115e5b8d93c4250d21c07aa480175b70ccb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 9


Intelligence 9 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f4df752b979c6c1784add5410ea5115e5b8d93c4250d21c07aa480175b70ccb
SHA3-384 hash: df866f5be54517adec1b973770ec088eeb01cf58c3b74dd4205f82052abbb86afd19587f57cd9f2072d549504789ece3
SHA1 hash: 327a6321814963da87875ffa1006df9bc1a71092
MD5 hash: c1e13835f0520c2e9cfd3c2cdb68eecb
humanhash: ack-angel-indigo-triple
File name:LunaUI_v8.32.364.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:98'183'104 bytes
First seen:2026-10-26 13:37:45 UTC
Last seen:2026-10-26 14:25:11 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 4f2f006e2ecf7172ad368f8289dc96c1 (184 x SalatStealer, 77 x Vidar, 46 x RemusStealer)
ssdeep 1572864:JIWrYZPRwLlx2M5J7VfdZZSeksQfj9hgO6El4mO:OW05K5Yy7jZce29KF/N
TLSH T1D1283303AD5491A8C5EECA34C6775023BA65BC5CD73533AB3E506A303F65BE06BB6B01
TrID 27.0% (.EXE) Win64 Executable (generic) (6522/11/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter smica83
Tags:exe HUN vidar

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-26 16:40:08 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/91a25167-8a4c-4998-be30-5ac33e006661

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
82.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6adf57d6afb06e650cd92e3d
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating synchronization primitives
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm bloated crypto golang overlay
Link:
https://www.filescan.io/uploads/6adf57cd0357eedc2f392c06/reports/9d05dcf2-610e-4e39-a1ad-03f713e662de/overview
Verdict:
Malicious
Labled as:
WinGo/GenKryptik.HUHV trojan
Link:
https://www.hybrid-analysis.com/sample/2f4df752b979c6c1784add5410ea5115e5b8d93c4250d21c07aa480175b70ccb
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-26T12:07:00Z UTC
Last seen:
2026-10-26T19:53:00Z UTC
Hits:
~10000
Link:
https://opentip.kaspersky.com/2f4df752b979c6c1784add5410ea5115e5b8d93c4250d21c07aa480175b70ccb/results?tab=lookup
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1991990
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Early bird code injection technique detected
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Monitors registry run keys for changes
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1991990 Sample: LunaUI_v8.32.364.exe Startdate: 26/10/2026 Architecture: WINDOWS Score: 100 56 mr-b01.tm-azurefd.net 2->56 58 ideas-irisselection-irisfd-lb.prod-b-eus2.ideas-irisselection-irisfd.eastus2-prod.cosmic.office.net 2->58 60 4 other IPs or domains 2->60 86 Suricata IDS alerts for network traffic 2->86 88 Found malware configuration 2->88 90 Multi AV Scanner detection for submitted file 2->90 92 5 other signatures 2->92 8 LunaUI_v8.32.364.exe 15 17 2->8         started        12 msedge.exe 14 132 2->12         started        14 msedge.exe 8 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 62 37.27.4.20, 443, 49716, 49745 HETZNER-ASDE Finland 8->62 94 Early bird code injection technique detected 8->94 96 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->96 98 Found many strings related to Crypto-Wallets (likely being stolen) 8->98 100 12 other signatures 8->100 18 msedge.exe 2 9 8->18         started        21 msedge.exe 9 8->21         started        23 msedge.exe 8->23         started        34 8 other processes 8->34 64 239.255.255.250 unknown ZZ 12->64 25 msedge.exe 12->25         started        28 msedge.exe 12->28         started        30 msedge.exe 12->30         started        32 msedge.exe 14->32         started        36 2 other processes 16->36 signatures6 process7 dnsIp8 84 Monitors registry run keys for changes 18->84 38 msedge.exe 18->38         started        40 msedge.exe 21->40         started        42 msedge.exe 23->42         started        66 mr-z01.tm-azurefd.net 150.171.110.17, 443, 49732, 49774 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 25->66 68 ln-0007.ln-dc-msedge.net 150.171.23.17, 443, 49735 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 25->68 74 7 other IPs or domains 25->74 70 192.168.2.10, 138, 443, 49682 unknown unknown 34->70 72 192.168.2.16 unknown unknown 34->72 44 chrome.exe 34->44         started        48 firefox.exe 34->48         started        50 msedge.exe 34->50         started        52 3 other processes 34->52 signatures9 process10 dnsIp11 76 www.google.com 142.251.157.119, 443, 49717, 49725 GOOGLE-GoogleLLCUS United States 44->76 78 mobile-gtalk.l.google.com 44->78 82 3 other IPs or domains 44->82 54 Chrome Cache Entry: 209, PDP-11 44->54 dropped 80 127.0.0.1 unknown unknown 48->80 file12
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2f4df752b979c6c1784add5410ea5115e5b8d93c4250d21c07aa480175b70ccb
Gathering data
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-26 13:38:34 UTC
File Type:
PE+ (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f5g7ouvzphdmc6ck3vkbb2srcxs3rwj4ijinehahvjeac5nxbtfq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/261026-qxkyases6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Reads the TCP/IP host and domain name from the registry
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:SUSPICIOUS_Potential_DDR
Create hunting rule
Author:NyxIndius
Description:Detects PE files referencing web services potentially used as dead drop resolvers, with network capability correlation for single-indicator cases
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments