MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
SHA3-384 hash: 8b15d8dac3c994860c9e8245e5c2c732477d01558c5756baea73b2b9d0316aa2b3e311b89d460cf566a83f5289f3ec09
SHA1 hash: c1de48eeb23bbc55756865d4ce889b835b5eb870
MD5 hash: 8036bafa809880527d97d999603f317a
humanhash: kentucky-vegan-alaska-echo
File name:70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
Download: download sample
Signature Vidar
Create hunting rule
File size:14'040'648 bytes
First seen:2026-07-07 14:42:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a014d7eeb4c2042897567e1288a095 (24 x HijackLoader, 23 x GhostPulse, 14 x ValleyRAT)
ssdeep 196608:+pCichBVLNwfL26GTCZKWDCsdyNn5iDvg6/ylzw6551mFaEXz5dMQdXVFh6s7LVi:+pCichj2PGeW0y0f2xhmlFSAFFh6s7LI
TLSH T15FE63312F78864BACB3A8D305F13C7426973E7694B93BD9BD8954E404CE62E0BB074D9
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (23 x GhostPulse, 23 x HijackLoader, 11 x LummaStealer)
Reporter adrian__luca
Tags:exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73530/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Replacing files
Сreating synchronization primitives
Connection attempt
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context evasive fingerprint installer installer installer-heuristic microsoft_visual_cc overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a4d15e72c20fd3584469806/reports/603fa939-397e-4e79-8880-a51004b25156/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-07T09:35:00Z UTC
Last seen:
2026-07-09T03:14:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3247871a-782c-4cc0-848c-f82c5a147697
Score:
77%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5/
Threat name:
Win32.Trojan.DllHijack
Create hunting rule
Status:
Suspicious
First seen:
2026-07-07 14:29:45 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ocde6kjywnsa7wzgsmuy6y7lvjzpibgwtmuzy6m2jvzww7srbtkq._file
Verdict:
malicious
Label(s):
admintool_advancedipscanner
Create hunting rule
Similar samples:
error
Vidar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader family:vidar botnet:b5bdf9644488e9d02429ab5406c6d433 credential_access discovery loader spyware stealer
Link:
https://tria.ge/reports/260707-ssza8sgs7t/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Family: Vidar
Malware Config
C2 Extraction:
https://95.217.245.14
https://telegram.me/turb00m
https://steamcommunity.com/profiles/76561198689449626
Unpacked files
SH256 hash:
70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
MD5 hash:
8036bafa809880527d97d999603f317a
SHA1 hash:
c1de48eeb23bbc55756865d4ce889b835b5eb870
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 hash:
c4a25dce665733663284750666684703
SHA1 hash:
368f3c3497c1b0121409216282803bcf1b64f35f
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01
MD5 hash:
1fb93933fd087215a3c7b0800e6bb703
SHA1 hash:
a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
3245b97f939bbfb0d6ad0732c48097a45b3b7a7f1081eba41562c08ff33130cd
MD5 hash:
a3bd87494bc7174bff35998c4f418afe
SHA1 hash:
0ed2b03bc45135af2367be0dc2d95073752c0da5
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
508f772bde00e8cee5e5d185b3e44003982843d283e8448e3a4b6b29b4ff28a8
MD5 hash:
f7a79aaa6a0075311756a488e49d12e0
SHA1 hash:
7608655af255b78f05b012497297e974044736f6
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
5ffbf8fd312922fc7aab26654f0da5d41cde2734c5321f8f4bcfd596c2660825
MD5 hash:
d52831bba5f65db7a1dd310c65c63ca1
SHA1 hash:
32ea3c1ec75c919ea587ae69d172345bb78b3aa0
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
63c05cfdd2ee44057e619d1a9acead538e867cbee55873529d01686d1ec678a6
MD5 hash:
b2d36d9e7aeb6fe317deaaf7cc4a34ed
SHA1 hash:
7eb1cdcf9a59a348064c2f41eedfd73bc00e7724
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
674e9e8f298c568798e965a9078f79578b07ef71d02a733231257a435f73b36d
MD5 hash:
cec0a6577e3f784bf44a7a13f88bbbe5
SHA1 hash:
138974a9f5e4b2d5dd18c7d135dbd884d99341d6
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
716a11cdc1b12827ee18027caa947f813cb3550412b5dcaae427be3bbcc0221f
MD5 hash:
8dfb8feccc75f737363de85f66e753a6
SHA1 hash:
7265f3dc35904256e1f33f8cc3bab085e7bb4eb2
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 hash:
7762c51ea02eb943183d597ea0ee5530
SHA1 hash:
0b8c307eba01d0679a2669210862d0afa888c40f
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
MD5 hash:
1b171f9a428c44acf85f89989007c328
SHA1 hash:
6f25a874d6cbf8158cb7c491dcedaa81ceaebbae
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
SH256 hash:
c73b6080ff81a42336be2baa3a159f746a054032615f53d0e1ff56d57c357b14
MD5 hash:
b722737394c97244372da91139e35e9e
SHA1 hash:
6700459d4a22469c72e22a302fad21549050f859
Link:
https://www.unpac.me/results/69a1f457-dc20-4913-9a4d-4519100d2e1a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73530/

Comments