MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments

SHA256 hash:	313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589
SHA3-384 hash:	0253829fc4752c03a2edfe70b760ee61d93e07775bc0de6ca8167deb6317aa583ea1f5c3f8c407d1fea839984262cc59
SHA1 hash:	a3353b67c5a12271386d0c8e9adede64cfae1cb8
MD5 hash:	46c4cb407a2144f74975ed0437e48a42
humanhash:	alabama-seven-kilo-delaware
File name:	313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589
Download:	download sample
Signature	Vidar Create hunting rule
File size:	12'800 bytes
First seen:	2026-08-10 14:24:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b5dedaa92e3b299ba2882a40f166187c (4 x Vidar)
ssdeep	192:OEzH9Enoh2kGefGuAl5Kirmabt0A/+pmykGQMDxWNIZVSBpEEhfOY3VjY:OE79Bh2kGefGzvK6bt0ATZM9WkEzlj
TLSH	T157422947B192E0B8C079937CCADB29B6C31730CA232E5BBF0BECD95867C255129B8714
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

phorpiex

ID:

File name:

almost there.zip

Verdict:

Malicious activity

Analysis date:

2026-07-15 08:05:22 UTC

Tags:

auto generic python metasploit framework opendir phorpiex botnet possible-phishing evasion remusstealer ipfs rustystealer stealer solaris loader action1rmm cobaltstrike tool nemucod phishing massbass powershell quasar rat github clickfix telegram koiloader guloader havoc xworm smoke asyncrat maskgram networm amus njrat bladabindi ip-check adware tinynuke cryptowall ransomware datto rmm-tool pastebin wannacry glamour ghostsocks proxyware cryptolocker remcos action1 susp-powershell stealc neshta discord pyinstaller

Link:

https://app.any.run/tasks/c3761c7f-a51c-4fc1-91a4-f06ea444c727

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/79857/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac1a920f0211e317742d515

Tags:

agentb virus agent remo

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Creating a file

Deleting a recently created file

Searching for synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

microsoft_visual_cc

Link:

https://www.filescan.io/uploads/6a79dfa7390d1165c1c3c193/reports/efe81f63-08d8-4f78-bfa8-fee456ac16cd/overview

Verdict:

Malicious

Labled as:

Vidar.Generic

Link:

https://www.hybrid-analysis.com/sample/313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-16T03:00:00Z UTC

Last seen:

2026-08-02T18:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c67578fd-e520-44a8-baa8-ed9705723450

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589/

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-07-15 12:56:18 UTC

File Type:

PE+ (Exe)

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ge7w6ic5meigzqre6tttgyseeilwzdvnqxduilygf2bataj7uweq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260810-rrnbxabk5z/

Unpacked files

SH256 hash:

313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589

MD5 hash:

46c4cb407a2144f74975ed0437e48a42

SHA1 hash:

a3353b67c5a12271386d0c8e9adede64cfae1cb8

Link:

https://www.unpac.me/results/6d15b989-2152-4190-967c-133cf3979901/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.