MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b
SHA3-384 hash:	e591f4533ff65ae426e26484138c7f15a55dc337dfc38a937c5a9c286d001d0952017673ffcfd3c990090850ed598bba
SHA1 hash:	d3dd4335bba9b507edfe1507ccfcf76b7d4ebbe4
MD5 hash:	ff777857f1152dde8b2f812725f3b777
humanhash:	charlie-uniform-juliet-eighteen
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	648'192 bytes
First seen:	2026-02-17 16:18:19 UTC
Last seen:	2026-02-17 17:37:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	272da274133b3bd9f0a6f58d3842d526 (1 x Vidar)
ssdeep	12288:VrW8rSu9JOwZD6GIlgjfnI48z4He981xvO6qYO:V3rSu9JOwFdbjf2z4He98jO6q
TLSH	T102D41ABDAC20E366F70D90BAE246D3534F2138410636A9A329BED7141246873DB577FE
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec vidar

abuse_ch

UPX decompressed file, sourced from SHA256 6c0c480e6182d5aa36385f8956489fd0fb9821045953751e0b861252daa93521

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	223'744 bytes
File size (de-compressed) :	648'192 bytes
Format:	win64/pe
Packed file:	6c0c480e6182d5aa36385f8956489fd0fb9821045953751e0b861252daa93521

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Vidar

Details

Vidar

c2 urls, useragents, c2 handshake magic parameters, a version, and a missionid

Link:

https://research.acce.ciphertechsolutions.com/results/4d362cf9-ad7a-455b-9696-378f9c0deb8b/

Malware family:

vidar

ID:

File name:

_6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b.exe

Verdict:

Malicious activity

Analysis date:

2026-02-17 16:51:47 UTC

Tags:

xor-url generic stealer stealc vidar

Link:

https://app.any.run/tasks/00d2b8cf-e00c-493b-a8f9-c3d78e9f1d96

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/53619/

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1870580

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect sleep reduction / modifications

Found malware configuration

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to detect virtualization through RDTSC time measurements

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b

Threat name:

Win64.Infostealer.Tinba

Status:

Malicious

First seen:

2026-02-17 16:19:16 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n7dhmdbegkph4exf4yuseayi63z2ohaug3e3y4ydclbja3fvfwfq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260217-tr655aew9c/

Unpacked files

SH256 hash:

6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b

MD5 hash:

ff777857f1152dde8b2f812725f3b777

SHA1 hash:

d3dd4335bba9b507edfe1507ccfcf76b7d4ebbe4

Detections:

SUSP_XORed_URL_In_EXE

SUSP_XORed_Mozilla

Link:

https://www.unpac.me/results/562ec253-b1ad-4f62-9c63-02f879971d25/

Parent samples :

6c0c480e6182d5aa36385f8956489fd0fb9821045953751e0b861252daa93521
6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6fc6760c2432/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	sus_pe_free_without_allocation Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution