MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9
SHA3-384 hash: 377ac44ded160349d84f46cc3bc511bc8b518d4868bd9688819c94e7a461cd5ef82d8379976526fa5fd2016e5276cbe0
SHA1 hash: ea6a1b20d47b33e5bc6cf0595ae35df468ae86da
MD5 hash: ba3dfcb42cddb873d924a5d4fe7f3309
humanhash: snake-red-robert-yankee
File name:badb192a3c2285c27b7ce0e459fcd9c0d8d84e16137830a8d03e68ac9ac654e4.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:1'390'592 bytes
First seen:2026-08-28 14:52:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:6s7knsCS/4gTRDFl3NM8bF/hLvZ5ZL4JUNFiyFjjclZhDP4icfQl2qVcBaP:6s7AS/4ilH9M4/1vZ5ZL4JAbR8ZqdQ
TLSH T1D055FB8EDA8213B5B392F773925AD7325CF6310680728A75CF457E354F52E20A478ECA
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe upx-dec vidar


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 badb192a3c2285c27b7ce0e459fcd9c0d8d84e16137830a8d03e68ac9ac654e4
File size (compressed) :364'032 bytes
File size (de-compressed) :1'390'592 bytes
Format:win64/pe
Packed file: badb192a3c2285c27b7ce0e459fcd9c0d8d84e16137830a8d03e68ac9ac654e4

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-08-28 14:57:49 UTC
Tags:
telegram evasion
Link:
https://app.any.run/tasks/7b296c58-7fcb-4f6e-ba92-3084ea5f39c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83170/
Detection(s):
SecuriteInfo.com.Variant.Lazy.732509.76254422.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6a91a0dbb2b07aac035e5cb2/reports/75dea84e-e0ca-4036-bdb4-9e2388e2121d/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-28T13:11:00Z UTC
Last seen:
2026-08-30T06:05:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9/results?tab=lookup
Gathering data
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1965320
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Monitors registry run keys for changes
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1965320 Sample: badb192a3c2285c27b7ce0e459f... Startdate: 28/08/2026 Architecture: WINDOWS Score: 100 59 nsn.12naga.org 2->59 61 telegram.me 2->61 63 fg.microsoft.map.fastly.net 2->63 93 Suricata IDS alerts for network traffic 2->93 95 Multi AV Scanner detection for submitted file 2->95 97 Yara detected AntiVM3 2->97 99 2 other signatures 2->99 9 badb192a3c2285c27b7ce0e459fcd9c0d8d84e16137830a8d03e68ac9ac654e4.exe 16 13 2->9         started        13 msedge.exe 13 92 2->13         started        15 msedge.exe 2->15         started        17 msedge.exe 2->17         started        signatures3 process4 dnsIp5 65 nsn.12naga.org 172.67.202.117, 443, 49736, 49788 CLOUDFLARENET-CloudflareIncUS Canada 9->65 67 telegram.me 149.154.167.99, 443, 49735 TELEGRAMVG United Kingdom 9->67 103 Early bird code injection technique detected 9->103 105 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 9->105 107 Found many strings related to Crypto-Wallets (likely being stolen) 9->107 109 11 other signatures 9->109 19 msedge.exe 2 9 9->19         started        22 msedge.exe 9->22         started        24 msedge.exe 9->24         started        33 8 other processes 9->33 69 239.255.255.250 unknown ZZ 13->69 26 msedge.exe 13->26         started        35 4 other processes 13->35 29 msedge.exe 15->29         started        37 2 other processes 15->37 31 msedge.exe 17->31         started        signatures6 process7 dnsIp8 101 Monitors registry run keys for changes 19->101 39 msedge.exe 19->39         started        41 msedge.exe 22->41         started        43 msedge.exe 24->43         started        71 mr-z01.tm-azurefd.net 150.171.109.145, 443, 49765 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 26->71 73 ax-0002.ax-msedge.net 150.171.27.11, 443, 49767, 49773 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 26->73 77 4 other IPs or domains 26->77 79 5 other IPs or domains 29->79 81 4 other IPs or domains 31->81 75 192.168.2.6, 138, 443, 49679 unknown unknown 33->75 83 2 other IPs or domains 33->83 45 chrome.exe 33->45         started        49 firefox.exe 33->49         started        51 msedge.exe 33->51         started        53 2 other processes 33->53 signatures9 process10 dnsIp11 85 mobile-gtalk.l.google.com 142.250.141.188, 49760, 5228 GOOGLE-GoogleLLCUS United States 45->85 87 www.google.com 142.251.151.119, 443, 49747, 49755 GOOGLE-GoogleLLCUS United States 45->87 89 android.l.google.com 142.251.215.206, 443, 49761 GOOGLE-GoogleLLCUS United States 45->89 57 Chrome Cache Entry: 265, PDP-11 45->57 dropped 91 127.0.0.1 unknown unknown 49->91 55 firefox.exe 49->55         started        file12 process13
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ba3dfcb42cddb873d924a5d4fe7f3309
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9/
Threat name:
Win64.Spyware.Vidar
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 14:53:17 UTC
File Type:
PE+ (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4m4ypiof2tou4iawybsujbwir6rbf3qyffxrqxybjtez4a4chmq._file
Verdict:
malicious
Label(s):
Vidar
Create hunting rule
Link:
https://reports.threatray.com/da53aa34-0beb-435b-814e-b8cbd9dd4283
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion
Link:
https://tria.ge/reports/260828-r9esgsbk3y/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Checks for VirtualBox DLLs, possible anti-VM trick
Checks system information in the registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9
MD5 hash:
ba3dfcb42cddb873d924a5d4fe7f3309
SHA1 hash:
ea6a1b20d47b33e5bc6cf0595ae35df468ae86da
Link:
https://www.unpac.me/results/8bed7ab2-ad0a-46ae-ae34-b0bd5ccee88b/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4f19cc3d0e2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe badb192a3c2285c27b7ce0e459fcd9c0d8d84e16137830a8d03e68ac9ac654e4

Vidar

Executable exe 4f19cc3d0e2ea6ea7100b6032a2436447d109770c14b78c2f80a664cf01c11d9

(this sample)

  
Dropped by
SHA256 badb192a3c2285c27b7ce0e459fcd9c0d8d84e16137830a8d03e68ac9ac654e4
Cape
Cape
https://www.capesandbox.com/analysis/83170/
  
Dropped by
MD5 7289b97fbf78c156ef5794bdcc5ffa6a
  
URLhaus
https://urlhaus.abuse.ch/url/3903903/
  
Delivery method
Distributed via web download

Comments