MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 14


Intelligence 14 IOCs YARA 28 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec
SHA3-384 hash: 031377a393a9c1d391828bc8a7057d2cb1692b3c3dc3b9bdd2cd1c23f2b6debec9339811794099bd93e94349f4106d14
SHA1 hash: ff380dee8af99102e536b64a077d91088ad3dd5e
MD5 hash: 5a74d53177d8c0b792e7ec32e7a9fa38
humanhash: purple-north-twelve-blue
File name:file
Download: download sample
Signature Vidar
Create hunting rule
File size:4'578'128 bytes
First seen:2025-10-01 04:04:47 UTC
Last seen:2025-10-01 04:04:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d42595b695fc008ef2c56aabd8efd68e (92 x Rhadamanthys, 66 x Vidar, 41 x LummaStealer)
ssdeep 49152:42wv4xa+GVp66ST5MhyefsMAjH6vPvvDui11wg7Hq8PhT:4aiSF9mui11rHPhT
Threatray 12 similar samples on MalwareBazaar
TLSH T116264B13A9A408E5C5E9A238C9A35212BB607D04473633EB3E9C75362F3A3D45E7EF54
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe vidar


Avatar
Bitsight
url: http://178.16.55.189/files/7435642179/nCDL53r.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
157
Origin country :
US US
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec.bin.exe
Verdict:
Malicious activity
Analysis date:
2025-10-01 00:19:38 UTC
Tags:
vidar stealer stealc golang
Link:
https://app.any.run/tasks/e984fd10-8a7b-4176-9153-78464597262c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29656/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dca8a17d643f33eab8f7a7
Tags:
injection emotet obfusc crypt
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm crypt golang invalid-signature signed stealer vidar
Link:
https://www.filescan.io/uploads/68dca8b474e5a289899b8868/reports/6e759f2f-5801-4728-ba5c-ac8275e2bb1e/overview
Verdict:
Malicious
Labled as:
TrojanSpy/Stealer.rn
Link:
https://www.hybrid-analysis.com/sample/703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-30T22:29:00Z UTC
Last seen:
2025-10-02T02:51:00Z UTC
Hits:
~10
Detections:
UDS:DangerousObject.Multi.Generic
Link:
https://opentip.kaspersky.com/703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ae33c067-bd6e-45fd-8975-970833957e72
Score:
12%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec/
Verdict:
Malicious
Threat:
Family.VIDAR
Link:
https://tip.neiki.dev/file/703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-01 00:19:40 UTC
File Type:
PE+ (Exe)
Extracted files:
29
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oa3ufi2dtlkr43xppmgojrromsa42dqtl44v7crcb4m3o23xnpwa._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
Similar samples:
182272eef867fc6f3bcb4dfd68e7e9d27098a68f8f05dd45c12bb000537ea2bd
Vidar
23b2938d3c84a2157ba0a8347c1b62cf3f05dd5eaf53ddcea431efe6434c2074
Vidar
26e6b93427949360b1b00f81af356a5b947b95ca021d8f4618fea76ec7f2c54d
Vidar
40552b3060c5758c0351895c93e3aa38234b375ef812e3577a6b6d144aa613cb
Vidar
4cfe5a076f8b5aeedafccaff49969c10d09468bbb795075099f10974248c23f8
Vidar
703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec
Vidar
8a6ac42273774f12b5e5f3bba953365cb44ca63a0dd888e301a295f34fff69fd
Vidar
a39eeadcebb774bd9b4273c198c8ce9d93c0ecd3c655325a87a9b040bd2ad495
Vidar
eb76458c04eee2af88d94ecdccc212573abbcb011ebab6287b683bb21dc03e36
Vidar
error
Vidar
+ 2 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:d076efdfc52a948699b45ad20f322ba8n stealer
Link:
https://tria.ge/reports/251001-en6mvssly7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Vidar
Vidar family
Malware Config
C2 Extraction:
https://telegram.me/rif0lm
https://5.75.222.230
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/146d7329-2a35-4a60-8d1f-dfade7df7d8d
Unpacked files
SH256 hash:
703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec
MD5 hash:
5a74d53177d8c0b792e7ec32e7a9fa38
SHA1 hash:
ff380dee8af99102e536b64a077d91088ad3dd5e
Link:
https://www.unpac.me/results/aac3adaa-c3f1-4faf-bfab-83d3a3b36374/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/703742a3439a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:gcleaner
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked gcleaner stealer malware samples.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Vidar_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe 703742a3439ad51e6eef7b0ce4c62e6481cd0e135f395f8a220f19b76b776bec

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3636112/
Cape
Cape
https://www.capesandbox.com/analysis/29656/

Comments