MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 18

Intelligence 18 IOCs YARA 14 File information Comments

SHA256 hash:	94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8
SHA3-384 hash:	1bd0f62a2f04d386f8ea8d364dae02912d99d3ad0932c86848d4b844cb9779399ba7d88434562746c54fd8d02eb48730
SHA1 hash:	4926362b21b7b7eef93d0f48e0b20761e0f60ace
MD5 hash:	8993974bb09d9302ea49e1dc4ab2d655
humanhash:	jupiter-alpha-ohio-ten
File name:	YSdQm5F.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	588'288 bytes
First seen:	2025-12-17 17:26:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	31e06ec6723bcc3b75c69a4521e4b8f5 (53 x Vidar)
ssdeep	12288:vHYcXvULfKQZ9/Q+Q04xjjcQ+jN75eaU913Iu:pMjKQw+QDxp+F0jL3
Threatray	318 similar samples on MalwareBazaar
TLSH	T191C4231B88C09A89F38DD5F079433F69E2E93B86506B315F70CB09918E5AC94A592D2F
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	amznemu
Tags:	exe UPX vidar

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	588'288 bytes
File size (de-compressed) :	1'353'216 bytes
Format:	win64/pe
Unpacked file:	0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/e5b7f2e5-6f79-49b9-974a-56a212e3d309/

Malware family:

meterpreter

ID:

File name:

2to1ep.exe

Verdict:

Malicious activity

Analysis date:

2025-12-15 22:35:07 UTC

Tags:

auto metasploit framework python github stealer stealc powershell clickfix possible-phishing phishing meterpreter backdoor payload amadey botnet telegram anydesk rmm-tool anti-evasion xenorat rat clipper diamotrix cryptowall ransomware cryptolocker miner vidar njrat bladabindi loader remote gh0st gh0stcringe generic evasion guloader tool putty purelogs havoc koistealer tinynuke cobaltstrike purecrypter svc powershellempire koiloader pyinstaller xmrig uac remcos mimikatz ghostsocks proxyware snake keylogger pushware adware masslogger nanocore muckstealer agenttesla vipkeylogger coinminer xred stealerium redline donutloader formbook rhadamanthys bruteratel azorult whitesnakestealer arechclient2 iobit screenconnect rdp

Link:

https://app.any.run/tasks/75df9d64-0e70-4494-8766-73d29acf97fa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/45334/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6942e7f5c97f4a807a3b92dd

Tags:

ransomware obfuscated emotet virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug crypter crypto fingerprint hacktool infostealer mikey obfuscated packed packed packed upx vidar

Link:

https://www.filescan.io/uploads/6942e7f384afa5547b5918e2/reports/963dbcd0-9e44-47df-8d14-d919b59b1566/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-12T12:50:00Z UTC

Last seen:

2025-12-19T10:30:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d0cb271a-726e-4e38-a6ba-ea70143b6668

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/8993974bb09d9302ea49e1dc4ab2d655

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2025-12-12 15:42:55 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=stinbemhjaxyxzzqqbr2yz53ibnmz36btntevlmefdtmz3qrlp4a._file

Verdict:

malicious

Label(s):

vidar

Vidar

396cd5ce66d77773dc436035469fac4ee50c680c82e085fe1b41b0e09f7a66c8

Vidar

6c644fd7ec9da6569d5808f37aacb67e3fc2263ae42b34e231f9cc4561571b56

Vidar

db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b

Vidar

+ 308 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:2aadd0938e8307b4c2b9d1462c0725f3 defense_evasion discovery spyware stealer trojan upx

Link:

https://tria.ge/reports/251223-pxs38synhy/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Time Discovery

UPX packed file

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects Vidar Stealer

Vidar

Vidar family

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561198761022496

Verdict:

Malicious

Tags:

Stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/b56fba06-43bf-4165-bd31-d29a91d13193

Unpacked files

SH256 hash:

94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

MD5 hash:

8993974bb09d9302ea49e1dc4ab2d655

SHA1 hash:

4926362b21b7b7eef93d0f48e0b20761e0f60ace

Link:

https://www.unpac.me/results/9329984a-b8ee-4c94-b914-ebc605e84489/

SH256 hash:

0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

MD5 hash:

fbb4aa754effd0207e23e40c9f1595c7

SHA1 hash:

dc7881f149bd0a47b358ef8e3d2172dad49d813b

Detections:

SUSP_XORed_URL_In_EXE

SUSP_XORed_Mozilla

Link:

https://www.unpac.me/results/9329984a-b8ee-4c94-b914-ebc605e84489/

Parent samples :

94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8
0c123691f58f567a62eb1202a285e07bf635a040a1b35427438c0bcef491a20d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/94d0d09187482f8be7308063ac67bb405accefc19b664aad8428e6ccee115bf8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)