MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f
SHA3-384 hash:	a6c5291f4c958b6326c69c78b37c9fb51f78ec048554d485a8d385ac7a3850a1fb1908a277b6376afd1ec02ea47b0251
SHA1 hash:	367d9918b10962c40798795353b894d4e2d47691
MD5 hash:	892cb07e1cd390ce0856a9c0ba6a7e30
humanhash:	angel-august-thirteen-echo
File name:	596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	99'699'640 bytes
First seen:	2026-10-03 19:10:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	c2d457ad8ac36fc9f18d45bffcd450c2 (74 x Vidar, 39 x RemusStealer, 24 x CobaltStrike)
ssdeep	1572864:BMyLfaZdLDz/sM+WX2veexhcgOwqfhWgP/+4DpqoFEhK4pDWOGkIOkKHTTzNmYrp:B1faZtLNmGe77OzhJX+4p+FWdRO5H7
TLSH	T1A0281207738800ECC94BDA7584B1097A57F23DEE5532B64E0E987EA42F1A7962F6CF44
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Kejult
Tags:	exe stealer vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

375

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-03 19:22:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c59e352b-cb89-4319-bc30-8cf52bccd841

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acf2b35350c7ee8cc155ce1

Tags:

injection obfusc virus

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

DNS request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm bloated crypto golang overlay

Link:

https://www.filescan.io/uploads/6ac15359af54e52581018890/reports/2952c9fa-fe12-4db8-bb24-b7ae02f5042b/overview

Hybrid Analysis WinGo/Kryptik.ABY trojan

Verdict:

Malicious

Labled as:

WinGo/Kryptik.ABY trojan

Link:

https://www.hybrid-analysis.com/sample/596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-03T18:11:00Z UTC

Last seen:

2026-10-04T18:31:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Ravartar

Threat name:

Win64.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-03 19:13:02 UTC

File Type:

PE+ (Exe)

AV detection:

16 of 38 (42.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lfx267nljphm7kwm2nsdmfjp2btgq7iqw57fslpqrqexovjfgr7q._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/f39f130b-0aba-40a5-ab76-9f87f190ea2b

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar botnet:5f8a6310d1d9ec28dcadb68e49ec5db8 defense_evasion discovery stealer

Link:

https://tria.ge/reports/261003-xv275awv6l/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Reads the TCP/IP host and domain name from the registry

Checks for VirtualBox DLLs, possible anti-VM trick

Checks system information in the registry

Checks BIOS information in registry

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Family: Vidar

Malware Config

C2 Extraction:

https://139.162.175.187
https://telegram.me/bj00tyr
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=64444700
https://steamcommunity.com/profiles/76561198630398488

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/596faf7dab4b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.