MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 593b391a23ff56696eb2ba54a45ec5eb9c6c574d2b45f5da8ef324cfa3dca95e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	593b391a23ff56696eb2ba54a45ec5eb9c6c574d2b45f5da8ef324cfa3dca95e
SHA3-384 hash:	fdcb8943d88360986c2f1e4aa7bf95b98fc8bd76ae04bcd0aeeab9491055b9fb7fab44da54e8fd0f96f736ef645edfca
SHA1 hash:	1673484eda0df81c82544935795534d40ea46396
MD5 hash:	68a302bd4a8f9bd9a533b3f80771e21f
humanhash:	ohio-undress-papa-california
File name:	593b391a23ff56696eb2ba54a45ec5eb9c6c574d2b45f5da8ef324cfa3dca95e.bin
Download:	download sample
File size:	98'662'824 bytes
First seen:	2026-09-03 22:03:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f0ea7b7844bbc5bfa9bb32efdcea957c (125 x Vidar, 68 x Sliver, 30 x RemusStealer)
ssdeep	1572864:cPu1innTA/MUU6RXj3lrCJwIe+udZy1e9NfX9uLAgeVufKV5crN/j+W59OW7L/:uBTA/MhUj3cheR8yZX9tT5c5B591H
TLSH	T1C92833037CA564A4CADA9638D2B642427734784E9B3033EB2F92F2B42F767E15B75311
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Anonymous
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

163

Origin country :

CH

Vendor Threat Intelligence

ACCE SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b201c54e-66c9-4638-b3c2-0f9847494c8b/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-03 22:17:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/023a544b-fa3a-4f45-ad9f-6dc51b58c815

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 bloated crypto golang masquerade overlay packed

Link:

https://www.filescan.io/uploads/6a99eeb76a0ed5fa85048820/reports/e02d591d-d1e2-46f7-96d3-06b20a938c87/overview

Hybrid Analysis WinGo/Kryptik.ZV trojan

Verdict:

Malicious

Labled as:

WinGo/Kryptik.ZV trojan

Link:

https://www.hybrid-analysis.com/sample/593b391a23ff56696eb2ba54a45ec5eb9c6c574d2b45f5da8ef324cfa3dca95e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-03T15:51:00Z UTC

Last seen:

2026-09-03T18:13:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/593b391a23ff56696eb2ba54a45ec5eb9c6c574d2b45f5da8ef324cfa3dca95e/results?tab=lookup

Nucleon Malprob Susipicious

Score:

65%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/593b391a23ff56696eb2ba54a45ec5eb9c6c574d2b45f5da8ef324cfa3dca95e

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-04 02:16:59 UTC

File Type:

PE+ (Exe)

AV detection:

10 of 38 (26.32%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=le5tsgrd75lgs3vsxjkkixwf5oogyv2nfnc7lwuo6msm7i64vfpa._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/5658d35a-2f94-4ca4-9030-690765eb217c

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar botnet:8871af746e869f200c6d738cc0b3bb1d stealer

Link:

https://tria.ge/reports/260903-1ypb8awhrd/

Behaviour

Suspicious behavior: EnumeratesProcesses

Family: Vidar

Malware Config

C2 Extraction:

https://46.62.133.5
https://telegram.me/nag0e
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63727183

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/593b391a23ff/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.