MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 7

Intelligence 7 IOCs YARA 17 File information Comments

SHA256 hash:	8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923
SHA3-384 hash:	f757180259952d2e0e8ae6b5a52c378cc91ea9d6d5dcec4250995ca0205d415d66224e4f6e1ee19e6d120003cc32f219
SHA1 hash:	fbbf365fa534198553e71691ea69ed4752090c5f
MD5 hash:	c42fb1ef578ced7b1fcf6c781d7b3b87
humanhash:	yellow-uranus-mobile-stream
File name:	Internet Download Manager IDM 6.48 Build 45.iso
Download:	download sample
Signature	Vidar Create hunting rule
File size:	28'114'944 bytes
First seen:	2025-12-23 17:31:37 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:gqmHCw8pbOwJqpIqmHCw8PbOwkhqqmHS7w8PbOwY:9FRU1FRmrPR8
TLSH	T13757D04FF3EA1478E4AAC37645769155E9F338206721AEDB45A0C478EF239E42E3E701
TrID	47.7% (.ISO/UDF) UDF disc image (2114500/1/6) 46.2% (.NULL) null bytes (2048000/1) 5.7% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ATN) Photoshop Action (5007/6/1) 0.0% (.ISO) ISO 9660 CD image (2545/36/1)
Magika	iso
Reporter	aachum
Tags:	178-22-24-175 iso VenomRAT vidar

iamaachum

https://downloadtorrentfile.com/hash/994da730342681843825b5156f9fe6cb2bc58aa8?name=Internet%20Download%20Manager%20IDM%206.48%20Build%2045

VenomRAT C2: 178.22.24.175:4449
Vidar C2:
https://telegram.me/gal17d
https://steamcommunity.com/profiles/76561198759765485
https://xet.multiatend.com.br/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	idm.reg
File size:	262 bytes
SHA256 hash:	6dcb8ae93eff330c3e532735955e2b1f40a7776bafa2b573c8392d01396ef42f
MD5 hash:	f8ed3042160368d6671f31558fe2b70e
MIME type:	text/x-ms-regedit
Signature	Vidar

File name:	IDMGrHlp.exe
File size:	7'904'544 bytes
SHA256 hash:	3720d4bf44e001d79de947d3ebcdab057a91ef3c4fa2d57cc8510fc06ec0ac37
MD5 hash:	ad79599a85faef35e9f981b9e464131d
MIME type:	application/x-dosexec
Signature	Vidar

File name:	idman642build45.exe
File size:	11'651'072 bytes
SHA256 hash:	3d4412dc3e6372cfaad93b15e3175515abee51e36f9b4dadb34bc2aa115b40f5
MD5 hash:	725dd7696deaba10f3fd8f4bb35d988b
MIME type:	application/x-dosexec
Signature	Vidar

File name:	IDMan.exe
File size:	7'904'544 bytes
SHA256 hash:	6e2fc0c835dd7030d0b0f8e0d90a5e2e90ba9bdb584beaec4a9e00fb3b3c026d
MD5 hash:	9544c5afa265ad95573dbc648ed06b41
MIME type:	application/x-dosexec
Signature	Vidar

Vendor Threat Intelligence

Malware configuration found for:

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f946e750-0c81-4817-af05-ee1c65921fe7/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=694ad22501c7b4a8fe5522d8

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context context-iso crypt embarcadero_delphi expand fingerprint inno installer installer installer-heuristic lolbin overlay packed

Link:

https://www.filescan.io/uploads/694ad21ee126b9ff438eb257/reports/153e6859-efa8-4795-93c5-9593a6f861dc/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923

Verdict:

Malicious

File Type:

iso

First seen:

2025-12-23T14:41:00Z UTC

Last seen:

2025-12-23T14:55:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.AntiAV.dcat

Link:

https://opentip.kaspersky.com/8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923/results?tab=lookup

Gathering data

Verdict:

Malicious

Threat:

Trojan.Win32.AntiAV

Link:

https://tip.neiki.dev/file/8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2025-12-23 17:32:20 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

4 of 36 (11.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rrqjerla3z4aboma5web2fakw4ld6ba2bzwvbc56fo74jaysrerq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/8c60924560de7800b980ed881d140ab7163f041a0e6d508bbe2bbfc483128923

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)