MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57c8bb3f6fdda6a423ef7bf6ca43f162480a56c9978554bfde4b5a54c6f181c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	57c8bb3f6fdda6a423ef7bf6ca43f162480a56c9978554bfde4b5a54c6f181c8
SHA3-384 hash:	716bae70abbf1633b4db673a288f0b21d96f2cba7d7770cc4f41c2f5faad6934fb14ec6bacd87b57ee92e91f56275a16
SHA1 hash:	e2263437a4bc0314ba31783ecc709d63d556a235
MD5 hash:	d73e5c57e071f753c34bb03c0c803c3a
humanhash:	papa-hawaii-ceiling-uncle
File name:	57c8bb3f6fdda6a423ef7bf6ca43f162480a56c9978554bfde4b5a54c6f181c8.bin
Download:	download sample
File size:	100'304'264 bytes
First seen:	2026-09-16 05:56:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ebc247a77b4d4a804b261f97a1fd075c (114 x Vidar, 32 x RemusStealer, 26 x Smoke Loader)
ssdeep	1572864:H4i9cxShPuTNME1S6NXXhB8YdnJOn+i5ZIygRe6anyBUlCqm4Wlv1qQJ/ze4:Yi9OS2TNMyRZz8MJ85Ty2UB4Wvkme4
TLSH	T162282357A81454E4D09DCE38C9E6941DE6643CC9A7F223934E27BD302F2A3CA9F6D706
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Anonymous
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

182

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 crypto golang masquerade overlay packed packed

Link:

https://www.filescan.io/uploads/6aaa2fba26dfe6c49e158d21/reports/3c045571-2ba5-46a7-8996-ee742f5aac13/overview

Hybrid Analysis WinGo/Kryptik.AAZ trojan

Verdict:

Malicious

Labled as:

WinGo/Kryptik.AAZ trojan

Link:

https://www.hybrid-analysis.com/sample/57c8bb3f6fdda6a423ef7bf6ca43f162480a56c9978554bfde4b5a54c6f181c8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-16T01:49:00Z UTC

Last seen:

2026-09-16T02:30:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/57c8bb3f6fdda6a423ef7bf6ca43f162480a56c9978554bfde4b5a54c6f181c8/results?tab=lookup

Nucleon Malprob Susipicious

Score:

57%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/57c8bb3f6fdda6a423ef7bf6ca43f162480a56c9978554bfde4b5a54c6f181c8

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-16 05:57:34 UTC

File Type:

PE+ (Exe)

AV detection:

10 of 36 (27.78%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k7elwp3p3wtkii7ppp3muq7rmjeauvwjs6cvjp66jnnfjrxrqhea._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/1bce494a-a4d6-470a-824b-1064fbffc963

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://tria.ge/reports/260916-gnpqfswbpa/

Behaviour

Suspicious behavior: EnumeratesProcesses

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/57c8bb3f6fdd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malpedia

https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar