MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb
SHA3-384 hash:	a1448e1301ffad3ce77012d90424a3017e130dd1193328e5f5625fbfc41a04a18234998f4cfd2e0cbcd8565d8492ab21
SHA1 hash:	36fcc12316b1f63faadf0d580f4de9066024da14
MD5 hash:	1b9017f8899eb7c9c26e03b0b31f25a0
humanhash:	lactose-low-pasta-grey
File name:	504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb
Download:	download sample
Signature	Vidar Create hunting rule
File size:	14'336 bytes
First seen:	2026-08-10 14:08:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1599d6927d08f88e02098ee396f7c0e4 (2 x Vidar)
ssdeep	192:OEhwpVs+EOA3idOx+6tt2J3BI8mIA5kwXoOf/Fhke3VJV:OKExd36+BI8mHkwXTf/FnlJ
TLSH	T1CB52F88BB2C325EAD169C3BDC9892396E7263094031E5FFF4DECC4AC769225025B8775
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/79728/

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Creating a file

Deleting a recently created file

Searching for synchronization primitives

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

microsoft_visual_cc mikey

Link:

https://www.filescan.io/uploads/6a79db72390d1165c1c3bfe3/reports/00b842ef-19e3-4e84-b6b4-17be5bfc7650/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-09T06:57:00Z UTC

Last seen:

2026-07-30T08:53:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0969939f-e955-450e-838e-a58946d05a90

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb/

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-07-09 13:47:37 UTC

File Type:

PE+ (Exe)

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kbhqyhiqaggoovj3hpqh4utbqyahkytgh2ypxkn5c4xe465cx75q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260810-rf14mazgpb/

Unpacked files

SH256 hash:

504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb

MD5 hash:

1b9017f8899eb7c9c26e03b0b31f25a0

SHA1 hash:

36fcc12316b1f63faadf0d580f4de9066024da14

Link:

https://www.unpac.me/results/5d105207-60ec-460b-8414-c416d7edc249/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.