MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920
SHA3-384 hash:	3a494f151b3e19d399fe91c13aa29d1ade3c4b5688c8c485cd5356e698e1cbbc011de944e37ee9669a452644003db34b
SHA1 hash:	5e3b9699f5cd662ebc0ac88b93909b33d8cd3dff
MD5 hash:	6cbeff32345ea4af605d331639976bcf
humanhash:	enemy-coffee-foxtrot-seventeen
File name:	random.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	2'311'168 bytes
First seen:	2025-10-07 18:29:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:JLinCoGEga3/2i9LBtDx41X7kHOmG5smOqD6Gso/DYznrLM:Oxz3hFtDYIumG59H6ubYDM
TLSH	T13EB5337994B36E3EC5C961BC95071D96064A434F1FEC9F0E7C9A1ACAEEE0F6AD0581C0
TrID	33.6% (.EXE) OS/2 Executable (generic) (2029/13) 33.1% (.EXE) Generic Win/DOS Executable (2002/3) 33.1% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

118

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN vidar

Malware family:

vidar

Alert

Create hunting rule

ID:

1

File name:

38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920.exe

Verdict:

Malicious activity

Analysis date:

2025-10-07 17:55:38 UTC

Tags:

stealer stealc vidar themida

Link:

https://app.any.run/tasks/e7634e06-f8f4-467c-a1d9-e2c3f9316f6e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/31012/

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e554197f305fa2545d5911

Tags:

emotet cobalt

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Behavior that indicates a threat

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated packed packed themidawinlicense

Link:

https://www.filescan.io/uploads/68e55c19f377ab231053ac5c/reports/c65e93d4-6091-4c8c-a6f7-6c6b7b271869/overview

Hybrid Analysis Win/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-07T15:04:00Z UTC

Last seen:

2025-10-08T08:53:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/bd60d3c6-fb16-4db1-90b8-8cabd0f62552

Joe Sandbox Vidar

Result

Threat name:

Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1790891

Signature

Allocates memory in foreign processes

Creates a thread in another existing process (thread injection)

Detected unpacking (changes PE section rights)

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Suricata IDS alerts for network traffic

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/6cbeff32345ea4af605d331639976bcf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920

ReversingLabs TitaniumCloud Win64.Trojan.Egairtigado

Threat name:

Win64.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-07 17:55:41 UTC

File Type:

PE+ (Exe)

Extracted files:

1

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hcvd3ixcwdnluzvdwr6nqzj2vuqnypwatmixjmw4h3zagkudleqa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/251007-w47zas1ns7/

Behaviour

Checks BIOS information in registry

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/8660a0e8-57a9-4ea0-8f1d-010a5256d93b

UnpacMe

Unpacked files

SH256 hash:

38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920

MD5 hash:

6cbeff32345ea4af605d331639976bcf

SHA1 hash:

5e3b9699f5cd662ebc0ac88b93909b33d8cd3dff

Link:

https://www.unpac.me/results/41532735-6a33-4a9e-a494-b223ff93e719/

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/38aa3da2e2b0/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe 38aa3da2e2b0daba66a3b47cd8653aad20dc3ec09b1174b2dc3ef2032a835920

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3657565/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/31012/