MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc
SHA3-384 hash: e8dc85aa456eb31c050eda2f409379e73f63d6d42c2fe3fef512537d3d12f48993e0cbc48a95ac591cef3c2c3143e455
SHA1 hash: 9024d7171e44331efc5cbeb580558deb47b1af4d
MD5 hash: 55ad3c515562be0c5b5bae109e0bc745
humanhash: hotel-iowa-seventeen-ten
File name:kythy.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:12'097'322 bytes
First seen:2026-07-12 07:23:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a014d7eeb4c2042897567e1288a095 (24 x HijackLoader, 23 x GhostPulse, 14 x ValleyRAT)
ssdeep 196608:+pvWnuS9X6aeGBq43Xp4K9spg1GMSstK8S2JEK8XQlsps5eRXg:+piL9KaNBjXpOmUcJEK/lsOei
Threatray 108 similar samples on MalwareBazaar
TLSH T179C633463B55B9FBCD50D23C4F1DF7F38AB0E6A128218BDB498A4D223E9764612478F1
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (23 x GhostPulse, 23 x HijackLoader, 11 x LummaStealer)
Reporter BlinkzSec
Tags:vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
_4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc.exe
Verdict:
Malicious activity
Analysis date:
2026-07-12 07:26:20 UTC
Tags:
hijackloader loader snappyclient rat stealer stealc vidar
Link:
https://app.any.run/tasks/585a561a-93e1-4805-bed3-a3baff80a891

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74300/
Detection(s):
SecuriteInfo.com.PUA.Win32.CandyOpen.23887.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a53413ea53b0ea1c820d8aa
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context downloader evasive fingerprint hijackloader installer installer installer-heuristic microsoft_visual_cc overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a5342a8f02b327c5a80b7d5/reports/5117274f-96da-4757-af83-8798b9d2894d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc
Verdict:
Malicious
File Type:
exe x32
Detections:
HEUR:Trojan.Win64.DllHijack.gen
Link:
https://opentip.kaspersky.com/4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d101d4dd-f1ee-458f-939a-40c4f7562ec7
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout SFX 7z Win 32 Exe x86
Link:
https://app.malva.re/file/55ad3c515562be0c5b5bae109e0bc745
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-12 07:19:32 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jskyebnkjrllcsbxpmv5tbfhwo3few54sfgprznkungosh3r2tga._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
snappyclient
Create hunting rule
tinyutility
Create hunting rule
hijackloader
Create hunting rule
Similar samples:
642ecaab44fc4a09fce541bc7c639e77a5f9aa5ef28ca87b595df3c87afb12f8
Vidar
70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
Vidar
905048266f359367fea147487dce73f4f7c40c631fa9e0dffc74cdebc787db33
Vidar
c88a5bba3b32d6c4cfe3c2d33ea8eb5ada10314a8e049ce02d5cda94abd5aeb8
Vidar
cccaa74eb48cc6152f062bff6416def6922875ff7da6bbd2fac5f75b3332493b
Vidar
error
Vidar
f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be
Vidar
+ 98 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader family:vidar botnet:0465cc06397a50a1f9c08b9f78ed6cf2 credential_access discovery loader spyware stealer
Link:
https://tria.ge/reports/260712-h8m8ssdz6m/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Family: Vidar
Malware Config
C2 Extraction:
https://94.130.41.8
https://telegram.me/af97ri
https://steamcommunity.com/profiles/76561198680197300
Unpacked files
SH256 hash:
4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc
MD5 hash:
55ad3c515562be0c5b5bae109e0bc745
SHA1 hash:
9024d7171e44331efc5cbeb580558deb47b1af4d
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
13168b4293875821534ca8c2ca5eda601532e768f31b3ef04b2c6ae021227dba
MD5 hash:
21a786d3a1fcce2a1c527ae67644aac7
SHA1 hash:
33c4f26a927eee5a7793f741a22e789d39c97c09
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
26bfb5ad454d32397047c2b1d96cecfb0216e4ae217d33c60bcd7bd8c1e52c99
MD5 hash:
c0edff7c142c084d8f1e470b1138fd30
SHA1 hash:
47a59314c9c3f777051158715acf5fcb1010c306
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
2915c7b486e23dc458bd16594ba2eecb2d0095c3951315f366e43efb57f6e025
MD5 hash:
ad3c4cbc2908156b83a529c67d70bc3d
SHA1 hash:
a009657e848a95d252ab754d5ef4c123f76a7218
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
a547c74ad96ea0b47a7057575fd0e4e177a6f720aeb5ad2cb7f3660e1a1a4eca
MD5 hash:
5a8211758c0cc5d06c8100631895ee1d
SHA1 hash:
ae8f24695049ba4e1eeeb423e565d0f26acf4eb8
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
eeb3cd436f4d285f666ed0d0522b72c4773134b28c3431d5356b0a52b849db04
MD5 hash:
36733f9e38dda5c00434be5321ec013a
SHA1 hash:
af65d2eed824ace7fda9ff491018ba89756f54ea
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
7143911cdfb49c34d4bcde212362edeb1a64ddce897f31d2f821f049257c8340
MD5 hash:
7a1960cdbdf123b33bebbc01288f883b
SHA1 hash:
b16b6640d3ef73d14d7152cda384c8dde60fbff1
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
SH256 hash:
5f2c90d35852edfee08d5158c02103f69d202bfb6b0097f467e7e64d58cfa4f6
MD5 hash:
89378f387cd34b19e300b9904f9e7180
SHA1 hash:
d08e4aeaa5bc8d6bbfdd8768c928b55166381d17
Link:
https://www.unpac.me/results/a4d0de32-81bd-4b1d-927e-39ba6b9d8603/
Malware family:
SHADOWLADDER
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4c958205aa4c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3885371/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74300/

Comments