MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 12

Intelligence 12 IOCs YARA 5 File information Comments

SHA256 hash:	5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b
SHA3-384 hash:	754fe001cf9d3435fa1a05b840dfab3cf505d505168bc1694d91d1dfa69d3017e9f65fc4d4003a37f4a5e9383aac706f
SHA1 hash:	b947aa8b8837c81bd062716d83d0416eb963b894
MD5 hash:	e9f33fc95166e8d3df08cac93d79934d
humanhash:	white-wyoming-alaska-diet
File name:	5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	365'056 bytes
First seen:	2026-09-03 16:22:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6ed4f5f04d62b18d96b26d6db7c18840 (512 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep	6144:9g9QXfF9jIisLYINc6wIsmjBTwgH1LG/DLGr2FXq65L7EtqOojtPIFhmb7IIi:AQXnR+Y2y2jBTRHA/3y2Vt5vEtqH5IFf
TLSH	T15674230F921C3808EDF8887615A937843B6C54BDFAE4E329D6ADC81D33B19479D82D76
TrID	64.7% (.EXE) UPX compressed Win64 Executable (70117/5/12) 25.0% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.EXE) OS/2 Executable (generic) (2029/13) 1.8% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	exe UPX vidar whack.sh

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	365'056 bytes
File size (de-compressed) :	1'390'080 bytes
Format:	win64/pe
Unpacked file:	bfd58bd43ba3879d118f928374d9c00bd0f1c0f22d7c1543cf806aee5ac431cd

Intelligence

File Origin

# of uploads :

# of downloads :

152

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/2fac96c2-5e46-439a-94fd-73be46aa0b9c/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-03 16:32:10 UTC

Tags:

Link:

https://app.any.run/tasks/e7b165ee-09cd-44ff-9aa2-b5f1744e9ddc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83796/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

microsoft_visual_cc packed packed packer upx

Link:

https://www.filescan.io/uploads/6a999ef0d8153b29b187ee5f/reports/243c8662-f27b-41e0-98e3-9aaa24fd503d/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-03T10:30:00Z UTC

Last seen:

2026-09-03T12:33:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/9661f051-1ac5-42d1-ae90-a251624c14d5

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/e9f33fc95166e8d3df08cac93d79934d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b/

Threat name:

Win64.Trojan.Vidar

Status:

Suspicious

First seen:

2026-09-03 16:23:16 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

20 of 36 (55.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l7qqkxen75od3swp2qxlmqsox7e5w6ys33yauxenfb2ckqb2yz5q._file

Verdict:

malicious

Label(s):

Vidar

Link:

https://reports.threatray.com/97cac270-b8f7-4647-9b8d-20fa514bdf05

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:a5d71ca3dd6c7e58d096018d80bd5a88 stealer upx

Link:

https://tria.ge/reports/260903-tvwtkaxvfs/

Behaviour

Suspicious behavior: EnumeratesProcesses

UPX packed file

Family: Vidar

Malware Config

C2 Extraction:

https://telegram.me/nag0e
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63727183

Unpacked files

SH256 hash:

5fe1055c8dff5c3dcacfd42eb6424ebfc9db7b12def00a5c8d287425403ac67b

MD5 hash:

e9f33fc95166e8d3df08cac93d79934d

SHA1 hash:

b947aa8b8837c81bd062716d83d0416eb963b894

Link:

https://www.unpac.me/results/b664a677-ce7f-43e7-ac98-27575646516f/

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5fe1055c8dff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.