MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 19

Intelligence 19 IOCs YARA 3 File information Comments

SHA256 hash:	7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124
SHA3-384 hash:	2f61ff4b04960b2b31b8b0c93cab897e66abef7fba4fd24cdb2a7c280b228feababd87597564c6529685eec57b11c692
SHA1 hash:	4e9a6bc572e2c3553e6208db08270937acb36e9c
MD5 hash:	6fc90e4328a021ba86690bf6bca50278
humanhash:	hot-diet-red-eight
File name:	21ea3203883ff65547782cbfc8abf1f74879f6c2e64c763446871b9e6aaefc24
Download:	download sample
Signature	Vidar Create hunting rule
File size:	1'361'920 bytes
First seen:	2026-11-09 08:12:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	12288:Dr2ey/DkS4zVqcy4kb2fUcR9ow8NnC1ZRZ4G5QoX:Dr2eycxrv3tL
TLSH	T14055208EE5821BB5B396EB33931ED6325CF735A584B28635CF45AE354F02E20A015ECD
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec vidar

abuse_ch

UPX decompressed file, sourced from SHA256 21ea3203883ff65547782cbfc8abf1f74879f6c2e64c763446871b9e6aaefc24

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	363'008 bytes
File size (de-compressed) :	1'361'920 bytes
Format:	win64/pe
Packed file:	21ea3203883ff65547782cbfc8abf1f74879f6c2e64c763446871b9e6aaefc24

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Vidar

Details

Link:

https://research.acce.ciphertechsolutions.com/results/34cff3d7-1be1-4fb2-ad08-4dd229193e1f/

Malware family:

vidar

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-09 14:39:50 UTC

Tags:

telegram stealer vidar

Link:

https://app.any.run/tasks/612b6c14-ce5f-4cb1-993f-2abf1d5416d0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/98318/

Detection(s):

Win.Infostealer.Vidar-10060509-0

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c51e1492c978625a6d61

Tags:

infosteal injection

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Gathering data

Verdict:

Malicious

Labled as:

Vidar.Generic

Link:

https://www.hybrid-analysis.com/sample/7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-16T05:38:00Z UTC

Last seen:

2026-10-16T12:58:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124/results?tab=lookup

Malware family:

Vidar

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0015bc45-9117-4a6e-9722-d076a60347d2

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/2002292

Behaviour

Behavior Graph:

n/a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/6fc90e4328a021ba86690bf6bca50278

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124/

Threat name:

Win64.Trojan.Wacatac

Status:

Malicious

First seen:

2026-10-14 07:14:05 UTC

File Type:

PE+ (Exe)

AV detection:

24 of 36 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pvhqilwfbp5hep74z4v6zkp4vvnynhwhgrnvcavtadzcwthyyesa._file

Verdict:

malicious

Label(s):

Vidar

Link:

https://reports.threatray.com/16b13109-ecbd-4a9f-bfae-4d63131fa9a9

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:19ccb70dbc12ef919d5869277e598933 discovery stealer

Link:

https://tria.ge/reports/261109-j31sdaa14w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Reads the TCP/IP host and domain name from the registry

Malware Config

C2 Extraction:

https://t.me/scii0n
https://steamcommunity.com/profiles/76561198622044578

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

pe_no_import_table

Link:

https://app.threat.zone/submission/5cd691ce-f7c5-4a82-a626-2949df9ea6f0

Malware Family:

vidar

Malicious:

True

Tags:

64bit payload polymorphic peexe

Link:

https://intel.virussign.com/intelligence/file/7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124

Unpacked files

SH256 hash:

7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124

MD5 hash:

6fc90e4328a021ba86690bf6bca50278

SHA1 hash:

4e9a6bc572e2c3553e6208db08270937acb36e9c

Link:

https://www.unpac.me/results/690691d5-55c9-4dd3-8d02-99bb9f197b91/

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7d4f042ec50b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.22

Link:

https://yomi.yoroi.company/submissions/7d4f042ec50bfa723ffccf2beca9fcad5b869ec7345b5102b300f22b4cf8c124

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.