MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Vidar
Vendor detections: 9
| SHA256 hash: | 35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d |
|---|---|
| SHA3-384 hash: | 77b5a877d7fce4371c6c7761d5567ff1974f67de473a2da58d45dd0a7d6fed08c368a90cbe5d2c247b9260067144e8ac |
| SHA1 hash: | 9e4ccb402336e984f255492a433e7bc279620afe |
| MD5 hash: | fa19567b9ddb0c325f9476d47587cc6a |
| humanhash: | batman-jersey-vegan-ten |
| File name: | 35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d |
| Download: | download sample |
| Signature | Vidar |
| File size: | 12'288 bytes |
| First seen: | 2026-08-10 14:14:29 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 309ffb298c8a47c3e92f759e8f202429 (3 x Vidar) |
| ssdeep | 192:OtEL4on1JlvjgV0Z0b5dJNQiUDE0tXnnozsDqwuT13ZOd4Z3ViNP:OW4onXlbgSZ0ldJKbDE0tXozsDzuh3CE |
| TLSH | T1FF42F9C7B1EAB0BDD2B4C278DE5B0777D3663085032B5EFB51D8C4A826839916174B27 |
| TrID | 33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | exe vidar |
Intelligence
File Origin
# of uploads :
1
# of downloads :
92
Origin country :
HUVendor Threat Intelligence
No detections
Malware family:
phorpiex
ID:
1
File name:
Still cant find it.zip
Verdict:
Malicious activity
Analysis date:
2026-07-13 19:58:58 UTC
Tags:
auto metasploit framework python solaris loader phorpiex botnet evasion ipfs powershell github phishing massbass maskgramstealer possible-phishing nemucod generic remusstealer asyncrat rat rustystealer stealer purehvnc quasar tinynuke action1rmm screenconnect tool rmm-tool remote njrat bladabindi smoke vidar adware pythonstealer cobaltstrike datto glamour maskgram stealc clickfix remus remcos pastebin action1 koiloader networm amus susp-powershell xworm cryptolocker ransomware cryptowall acr guloader rhadamanthys gh0st ip-check putty purelogs wannacry pyinstaller coinminer miner pushware qrcode autoit lumma meterpreter stealerium netsupport websocket bruteratel donutloader advancedinstaller susp-script salatstealer exfiltration telegram arch-scr arch-exec redline
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Deleting a recently created file
Searching for synchronization primitives
Launching a service
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
microsoft_visual_cc
Verdict:
Malicious
Labled as:
Vidar.Generic
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-10T12:26:00Z UTC
Last seen:
2026-08-12T05:33:00Z UTC
Hits:
~10
Verdict:
Unknown
Score:
99%
Verdict:
Malware
File Type:
PE
Gathering data
Threat name:
Win64.Trojan.Vidar
Status:
Malicious
First seen:
2026-08-10 14:26:28 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 36 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Unpacked files
SH256 hash:
35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d
MD5 hash:
fa19567b9ddb0c325f9476d47587cc6a
SHA1 hash:
9e4ccb402336e984f255492a433e7bc279620afe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | SUSP_XORed_URL_In_EXE |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects an XORed URL in an executable |
| Reference: | https://twitter.com/stvemillertime/status/1237035794973560834 |
| Rule name: | SUSP_XORed_URL_in_EXE_RID2E46 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects an XORed URL in an executable |
| Reference: | https://twitter.com/stvemillertime/status/1237035794973560834 |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.