🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c
SHA3-384 hash: 8511d43f8b18f0fbea7bf8a75cf4693b2e09bff1c91a0f6a342c8724bbc78c88e3aac80fb76793a857d5d59b8e0bad8d
SHA1 hash: a8c25e5f089ce28ef58161d9c2a6fe45b466c84e
MD5 hash: 674c015384f6622bf783d95ac3e97f97
humanhash: network-louisiana-alabama-mobile
File name:d5da5eac4558ed7aa5813b6e362627944f485fd629c009aa1f8190ae17d30b35
Download: download sample
Signature Vidar
Create hunting rule
File size:912'421 bytes
First seen:2026-11-09 09:05:58 UTC
Last seen:2026-11-09 09:28:18 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
ssdeep 24576:8z7OiBSSLZbT4jzOSbRjgT1hcVl14WVSOD1NwgdN9xdWoSY1Y:8z7OiBSSLZbT4jzOSbRjgT1hcVl14WVm
TLSH T15E156C54779341D5E036593AD5CEAA27F1A2BD1A5AF4CF6B1700CFC62AE32A0235B313
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe upx-dec vidar


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 d5da5eac4558ed7aa5813b6e362627944f485fd629c009aa1f8190ae17d30b35
File size (compressed) :331'301 bytes
File size (de-compressed) :912'421 bytes
Format:win64/pe
Packed file: d5da5eac4558ed7aa5813b6e362627944f485fd629c009aa1f8190ae17d30b35

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
Vidar
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d781e41f-0f2b-4fb6-9221-8a55552a9bce/
Malware family:
vidar
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-09 21:47:15 UTC
Tags:
telegram stealer vidar
Link:
https://app.any.run/tasks/e023f595-7c5e-4278-a045-3be9d42d2aa2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98719/
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1ca671492c978625a7f11
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Capa_get_OS_information_via_KUSER_SHARED_DATA
Link:
https://www.hybrid-analysis.com/sample/8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-28T18:04:00Z UTC
Last seen:
2026-10-29T22:54:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c/results?tab=lookup
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2001615
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Monitors registry run keys for changes
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2001615 Sample: d5da5eac4558ed7aa5813b6e362... Startdate: 09/11/2026 Architecture: WINDOWS Score: 100 77 xk.akuntoti.net 2->77 79 t.me 2->79 81 2 other IPs or domains 2->81 121 Suricata IDS alerts for network traffic 2->121 123 Antivirus detection for URL or domain 2->123 125 Antivirus detection for dropped file 2->125 127 4 other signatures 2->127 8 d5da5eac4558ed7aa5813b6e362627944f485fd629c009aa1f8190ae17d30b35.exe 16 20 2->8         started        13 msedge.exe 2->13         started        15 msedge.exe 2->15         started        17 10 other processes 2->17 signatures3 process4 dnsIp5 97 xk.akuntoti.net 104.21.65.216, 443, 49703, 49797 CLOUDFLARENET-CloudflareIncUS Canada 8->97 99 t.me 149.154.167.99, 443, 49702 TELEGRAMVG United Kingdom 8->99 101 miip.live 173.255.202.15, 443, 49805, 49806 AKAMAI-LINODE-APAkamaiConnectedCloudSG United States 8->101 71 C:\ProgramData\d3a7f6a080\e40b6c2c.exe, PE32+ 8->71 dropped 73 C:\ProgramData\d3a7f6a080\cebf4456.exe, PE32+ 8->73 dropped 75 C:\ProgramData\d3a7f6a080\577a1271.exe, PE32+ 8->75 dropped 131 Early bird code injection technique detected 8->131 133 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->133 135 Found many strings related to Crypto-Wallets (likely being stolen) 8->135 137 9 other signatures 8->137 19 cmd.exe 8->19         started        21 chrome.exe 1 8->21         started        24 msedge.exe 8->24         started        31 10 other processes 8->31 103 239.255.255.250 unknown ZZ 13->103 27 msedge.exe 13->27         started        33 2 other processes 13->33 29 msedge.exe 15->29         started        35 2 other processes 15->35 105 127.0.0.1 unknown unknown 17->105 37 4 other processes 17->37 file6 signatures7 process8 dnsIp9 39 577a1271.exe 19->39         started        42 conhost.exe 19->42         started        83 192.168.2.10, 138, 443, 49576 unknown unknown 21->83 44 chrome.exe 21->44         started        129 Monitors registry run keys for changes 24->129 47 msedge.exe 24->47         started        85 mr-z01.tm-azurefd.net 150.171.109.148, 443, 49712, 49771 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 27->85 87 ln-0007.ln-msedge.net 150.171.22.17, 443, 49768, 49784 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 27->87 91 9 other IPs or domains 27->91 93 3 other IPs or domains 29->93 89 192.168.2.4 unknown unknown 31->89 49 e40b6c2c.exe 31->49         started        51 chrome.exe 31->51         started        53 chrome.exe 31->53         started        57 5 other processes 31->57 95 2 other IPs or domains 37->95 55 conhost.exe 37->55         started        signatures10 process11 dnsIp12 59 C:\Users\user\AppData\Local\...\guappcore.dll, PE32+ 39->59 dropped 61 C:\Users\user\...behaviorgraphoogleChromeSetup.exe, PE32+ 39->61 dropped 63 C:\Users\user\...\ChromeRecoveryAgent.exe, PE32+ 39->63 dropped 65 C:\Users\user\...\ChromeBackgroundService.exe, PE32+ 39->65 dropped 107 www.google.com 142.251.154.119, 443, 49721, 49728 GOOGLE-GoogleLLCUS United States 44->107 109 mobile-gtalk.l.google.com 142.251.2.188, 49733, 5228 GOOGLE-GoogleLLCUS Canada 44->109 111 android.l.google.com 44->111 67 Chrome Cache Entry: 294, PDP-11 44->67 dropped 69 C:\ProgramDatabehaviorgraphoogle\...behaviorgraphoogleUpdate.exe, PE32+ 49->69 dropped 113 142.251.152.119, 443, 49738, 49744 GOOGLE-GoogleLLCUS United States 51->113 119 2 other IPs or domains 51->119 115 142.251.156.119, 443, 49751, 49760 GOOGLE-GoogleLLCUS United States 53->115 117 android.l.google.com 53->117 file13
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/674c015384f6622bf783d95ac3e97f97
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c/
Threat name:
Win64.Spyware.Vidar
Create hunting rule
Status:
Malicious
First seen:
2026-10-28 12:51:04 UTC
File Type:
PE+ (Exe)
AV detection:
25 of 36 (69.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxoqhp5wj2pbhncc3wbqvnmb5mzylsvqh33mdrakipa53lqa5coa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/261109-k2w88sec28/
Behaviour
Suspicious behavior: EnumeratesProcesses
Reads the TCP/IP host and domain name from the registry
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
pe_no_import_table
Link:
https://app.threat.zone/submission/ed5b9ceb-11f6-4829-a454-b295120af56f
Malware Family:
vidar
Create hunting rule
Malicious:
True
Tags:
file-overlay 64bit peexe payload
Link:
https://intel.virussign.com/intelligence/file/8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c
Unpacked files
SH256 hash:
8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c
MD5 hash:
674c015384f6622bf783d95ac3e97f97
SHA1 hash:
a8c25e5f089ce28ef58161d9c2a6fe45b466c84e
Link:
https://www.unpac.me/results/8f734dbd-53e8-4f72-b95b-c1319bc75b1b/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8ddd03bfb64e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe d5da5eac4558ed7aa5813b6e362627944f485fd629c009aa1f8190ae17d30b35

Vidar

Executable exe 8ddd03bfb64e9e13b442dd830ab581eb3385cab03ef6c1c40a43c1ddae00e89c

(this sample)

  
Dropped by
SHA256 d5da5eac4558ed7aa5813b6e362627944f485fd629c009aa1f8190ae17d30b35
  
URLhaus
https://urlhaus.abuse.ch/url/3915327/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/98719/
  
Dropped by
MD5 7594d7be86254a7809ea25da178a8568

Comments