MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 7 File information Comments

SHA256 hash:	85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96
SHA3-384 hash:	e9049e2f264d89f37786a8f4bda7c1422fa6fafafdc382d3ef23ad077980cbb4dc20eb030d19009c19f1746a4de3ded6
SHA1 hash:	6f781fc16d991d3f6464269a069333c9bdfca76d
MD5 hash:	68779f60cc808c87f2b96ee059394683
humanhash:	comet-burger-cold-magazine
File name:	85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96
Download:	download sample
Signature	Vidar Create hunting rule
File size:	366'592 bytes
First seen:	2026-11-09 07:54:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	6ed4f5f04d62b18d96b26d6db7c18840 (1'180 x SalatStealer, 78 x BitRAT, 64 x Vidar)
ssdeep	6144:e4/6UelwtBipJS/MG5XTeLtxS08DzzdzzZ5pfIeOk90JzJQ/Y0WGXXhbmR:NCUTqpU9jeLv18PztpNbVWsRC
TLSH	T1FB741306B11B560CE5F8C1FD4B642B867AAD673DBA48E3A783BFE52A3744E110943C5C
TrID	64.7% (.EXE) UPX compressed Win64 Executable (70117/5/12) 25.0% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.EXE) OS/2 Executable (generic) (2029/13) 1.8% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe UPX vidar

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	366'592 bytes
File size (de-compressed) :	1'384'960 bytes
Format:	win64/pe
Unpacked file:	534da8160e803a9b53203d2fec7e1b5cde635bb8c6dceaddddee76d5736c5c99

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/18459f10-0070-41c2-90e7-e7eb4fbd79da/

Malware family:

vidar

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-09 13:34:49 UTC

Tags:

telegram stealer vidar upx

Link:

https://app.any.run/tasks/248013e0-0ccb-4e23-9485-05a902271fa8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/98168/

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Behavior that indicates a threat

Sending an HTTP GET request

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-07T08:55:00Z UTC

Last seen:

2026-10-19T08:46:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/b1efdf6b-79f5-4204-9a67-3a4175f9869a

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout UPX Win 64 Exe x64

Link:

https://app.malva.re/file/68779f60cc808c87f2b96ee059394683

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96/

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-10-07 12:10:28 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qx2bndvwcrkdjmz7fxygygitfncxw4qrtoy77ijdarq6p3eofkla._file

Verdict:

malicious

Label(s):

Vidar

Link:

https://reports.threatray.com/dd7e9ffe-432e-47a2-a121-9643d13157aa

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:62e8f01987466ae8396d7dad6ab3e7a6 discovery stealer upx

Link:

https://tria.ge/reports/261109-jsb19svz2j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Reads the TCP/IP host and domain name from the registry

UPX packed file

Family: Vidar

Malware Config

C2 Extraction:

https://t.me/bj00tyr
https://steamcommunity.com/profiles/76561198630398488

Malware Family:

n/a

Verdict:

Malicious

Tags:

rat

YARA:

SUSP_Imphash_Mar23_3

Link:

https://app.threat.zone/submission/e957d91f-dccc-4dd1-a2fa-9481c42ac998

Malware Family:

doina

Malicious:

True

Tags:

peexe polymorphic upx file-corrupted 64bit

Link:

https://intel.virussign.com/intelligence/file/85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96

Unpacked files

SH256 hash:

85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96

MD5 hash:

68779f60cc808c87f2b96ee059394683

SHA1 hash:

6f781fc16d991d3f6464269a069333c9bdfca76d

Detections:

SUSP_Imphash_Mar23_3

Link:

https://www.unpac.me/results/a665d267-c53e-4aa2-8288-d95fe1d04718/

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/85f4168eb614/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.22

Link:

https://yomi.yoroi.company/submissions/85f4168eb6145434b33f2df06c19132b457b72119bb1ffa1230461e7ec8e2a96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	SUSPICIOUS_Potential_DDR Create hunting rule
Author:	NyxIndius
Description:	Detects PE files referencing web services potentially used as dead drop resolvers, with network capability correlation for single-indicator cases

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	VIGIA_Vidar_c7269e33 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	Vidar-associated sample detection using corroborated string layouts or code constants
Reference:	https://vigia.bisite.es/