MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56b77af451ae0a131689e1cb3a8964b210403cded8d5ea67fa2b6ec24edabab7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	56b77af451ae0a131689e1cb3a8964b210403cded8d5ea67fa2b6ec24edabab7
SHA3-384 hash:	7d0cc1148d8367eed18db231b7a02d1e42dda0388670f9ab2992621663ac0a3e3965b30de3336678a31071f57c152d6d
SHA1 hash:	392bd45a3274658c49b3156da00cbbd78f62cfd9
MD5 hash:	2fb71121735dce231c14f87acb1ee271
humanhash:	michigan-spaghetti-delta-two
File name:	56b77af451ae0a131689e1cb3a8964b210403cded8d5ea67fa2b6ec24edabab7.bin
Download:	download sample
File size:	95'517'096 bytes
First seen:	2026-09-03 22:03:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f0ea7b7844bbc5bfa9bb32efdcea957c (125 x Vidar, 68 x Sliver, 30 x RemusStealer)
ssdeep	1572864:cPOgijZQ1YG2q7+d8zRXHUSXofymkRf1GeW4WUGKwl/Qsnv:uSZQ1YG2q7LzR3UScyrfceBjE
TLSH	T1332833077CA565A8CADE9638D6B542537634784EAB3033EB2F82B2B42F727D15B74310
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Anonymous
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

168

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-03 22:13:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/349f65ad-29cc-4012-9b6e-c257e05c8aeb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 bloated crypto golang masquerade overlay packed

Link:

https://www.filescan.io/uploads/6a99eeb3dee63648999d22d1/reports/8cb0564d-f61d-42cd-8ba2-f13be405640f/overview

Hybrid Analysis WinGo/Kryptik.ZV trojan

Verdict:

Malicious

Labled as:

WinGo/Kryptik.ZV trojan

Link:

https://www.hybrid-analysis.com/sample/56b77af451ae0a131689e1cb3a8964b210403cded8d5ea67fa2b6ec24edabab7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-03T16:05:00Z UTC

Last seen:

2026-09-03T18:15:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/56b77af451ae0a131689e1cb3a8964b210403cded8d5ea67fa2b6ec24edabab7/results?tab=lookup

Nucleon Malprob Malware

Score:

71%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/56b77af451ae0a131689e1cb3a8964b210403cded8d5ea67fa2b6ec24edabab7

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-04 02:16:57 UTC

File Type:

PE+ (Exe)

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k23xv5crvyfbgfuj4hftvclewiieapg63dk6uz72fnxmetw2xk3q._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/97dcae98-38a9-400f-a38e-ab5a4b2ea7f5

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar botnet:8871af746e869f200c6d738cc0b3bb1d stealer

Link:

https://tria.ge/reports/260903-1yqkaawhrf/

Behaviour

Suspicious behavior: EnumeratesProcesses

Family: Vidar

Malware Config

C2 Extraction:

https://46.62.133.5
https://telegram.me/nag0e
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63727183

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/56b77af451ae/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.