MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 14


Intelligence 14 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf
SHA3-384 hash: 8093b906ebdec62346e0e33574471bd6aa71a5fac28c16d460c34f269bdfc2e01d4ae9d0fd0e38555aa84a24f2dcd3f8
SHA1 hash: 8c7ea2cc07a3f50f0b4a0cccbd7726d4d730b62e
MD5 hash: 164a7c07a57e5af5c99bee86df627d89
humanhash: harry-mountain-mars-earth
File name:file
Download: download sample
Signature Vidar
Create hunting rule
File size:5'894'008 bytes
First seen:2026-06-16 20:44:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d42595b695fc008ef2c56aabd8efd68e (449 x Vidar, 96 x Stealc, 92 x Rhadamanthys)
ssdeep 98304:YH6EGEXHmgodI8N09MdU98NU9UuLEQZgA6Jr8ry6mRjHHHHHoHHHHHPHHHHHPHHs:YKEXHmgodI8N09MdU98NU9UuLEQZgA6x
Threatray 18 similar samples on MalwareBazaar
TLSH T1D656AE0BAFD80992E18DA17109BABA11737478951B2327C32B64773D3E736F0A9F5B50
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:d52f85 dropped-by-amadey exe signed vidar

Code Signing Certificate

Organisation:sindimec.org.br
Issuer:sindimec.org.br
Algorithm:sha256WithRSAEncryption
Valid from:2026-06-16T20:22:28Z
Valid to:2027-06-16T20:22:28Z
Serial number: 5a6bfceb330b7596
Thumbprint Algorithm:SHA256
Thumbprint: 1a70082f5e382ff00e19fb4b8f988311ba815e613b72f88f38c7c2cc86e7cd24
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://62.60.226.140/files/7852450268/qZTRUwz.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
_a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf.exe
Verdict:
Malicious activity
Analysis date:
2026-06-16 20:48:12 UTC
Tags:
stealer stealc vidar golang
Link:
https://app.any.run/tasks/f107ce89-bb61-4027-be3a-2d41d172e6c6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70998/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a31b6041a97308eef89b4b3
Tags:
extens virus lien sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Behavior that indicates a threat
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-vm base64 crypto golang packed signed
Link:
https://www.filescan.io/uploads/6a31b5f9deaa1a04f0db9818/reports/2c8a5275-5cdb-4034-a106-29d3ecb7bf39/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf
Verdict:
Clean
File Type:
exe x64
Link:
https://opentip.kaspersky.com/a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6d47408b-022f-4e5c-9c4f-ed2413c62d92
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwh475yoag4p7e6c5m2zuj44hkowx5oss55yipprsd5ds2dbkphq._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
Similar samples:
4bc82ebc691ce659b591db26ce756df0bd2da2959a0f84c2deba108f12660993
Vidar
7c31714b869453bd2e9f0e6506b1feb095b743fa191911b3115be14875f430e8
Vidar
8dad6a8959c22110eedb059425dd4040c9b7a1d60dfc8a3ad0b5f17a995ed472
Vidar
a1c20108b2ddb67fd2d4470899e8c952f69d70571c6dc6d404a3e5b2cdc6b3eb
Vidar
ac749f9dbf057765ac25ac6220be614a3601fcd716b9d1e6e971e50929c680f1
Vidar
d39d1b646d36414f6b25db3a217914f4acf557303dff7ead47761772cfd64b05
Vidar
da8f3c1a601a97001962064e9125f7a515045eca3746a7de037f411fa1651dbb
Vidar
df6068e8572d168939c76d91f9913b696b2da41c49f8fd951211e3907cb2ca34
Vidar
error
Vidar
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/260616-zj4mxses2r/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Unpacked files
SH256 hash:
a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf
MD5 hash:
164a7c07a57e5af5c99bee86df627d89
SHA1 hash:
8c7ea2cc07a3f50f0b4a0cccbd7726d4d730b62e
Link:
https://www.unpac.me/results/088e7511-d8f1-4432-85ea-470d5759bbf4/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a58fcff70e01/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.71
Link:
https://yomi.yoroi.company/submissions/a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RemusStealer_GoPayload
Create hunting rule
Author:burger
Description:Detects RemusStealer Go-compiled payload
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/70998/

Comments