🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
SHA3-384 hash: 488b0249b65790459c7f3c9d0b044c944b250c4b8da1e738d7e955982bc7d9cc0a10d10e91208408720c2ccf0a47c193
SHA1 hash: 89a64a719da47d46cdd0248d940751b1283f6032
MD5 hash: 109451d265aae647565d10eb9e591569
humanhash: nuts-wisconsin-yellow-river
File name:file
Download: download sample
Signature Vidar
Create hunting rule
File size:2'849'792 bytes
First seen:2025-12-11 13:12:09 UTC
Last seen:2025-12-13 06:04:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (103 x LummaStealer, 85 x RedLineStealer, 63 x Rhadamanthys)
ssdeep 49152:xExyflRqOwPvVev+/BsSzw75N0o2EqMXDn6mZQMaBlSl:OxQlRD7v+/qSzwtN0EqMXDn6mZ1WSl
TLSH T1AED5334672D490B2D0B4A73984F347935B36BDE427342A6F7284F17A6D33AC5A1B0F92
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon b8f4f2f8f2f4f831 (1 x Vidar)
Reporter Bitsight
Tags:BB4.file dropped-by-gcleaner exe vidar x


Avatar
Bitsight
url: http://194.38.20.224/service

Intelligence

File Origin
# of uploads :
10
# of downloads :
157
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Archives AutoIt
Details
Archives
an extracted Cabinet archive from the resources and SFX parameters
Link:
https://research.acce.ciphertechsolutions.com/results/b0301799-1fd6-4418-95bb-58c8ef4ad878/
Malware family:
vidar
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-12-11 13:14:22 UTC
Tags:
lumma stealer autoit stealc vidar xor-url generic
Link:
https://app.any.run/tasks/01f99014-e219-43c4-8d14-22b0cbc7cf26

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44287/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693ac335bde6a3e59710442e
Tags:
autoit emotet
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit CAB expand explorer installer installer installer-heuristic lolbin makecab microsoft_visual_cc packed rundll32 runonce sfx
Link:
https://www.filescan.io/uploads/693ac332900ee247e8421615/reports/a8dd14d0-1917-41af-af59-a97333815de1/overview
Verdict:
Malicious
Labled as:
Win64/Packed.CAB
Link:
https://www.hybrid-analysis.com/sample/6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-11T10:45:00Z UTC
Last seen:
2025-12-13T00:23:00Z UTC
Hits:
~100
Detections:
Backdoor.Win32.Agent.myxbil Backdoor.Agent.UDP.C&C
Link:
https://opentip.kaspersky.com/6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/16cde28f-4df1-4150-aab8-cb93b15a25af
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
AutoIt CAB:COMPRESSION:LZX Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/109451d265aae647565d10eb9e591569
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmeacc7wuuki5jskxxvd5x5mb3irujytpxxr7d3onr5js2dqvdua._file
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:105d327c1b536779a1b39be53053b37c discovery persistence spyware stealer
Link:
https://tria.ge/reports/251211-qfmesscs6d/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Detects Vidar Stealer
Vidar
Vidar family
Malware Config
C2 Extraction:
https://steamcommunity.com/profiles/76561198761022496
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/944567df-2a78-4e5c-8118-bdd1898e5192
Unpacked files
SH256 hash:
6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
MD5 hash:
109451d265aae647565d10eb9e591569
SHA1 hash:
89a64a719da47d46cdd0248d940751b1283f6032
Link:
https://www.unpac.me/results/e4b7fbc9-24b1-4f55-b0a0-86a0654af957/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6b08010bf6a5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/44287/

Comments