🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 16


Intelligence 16 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
SHA3-384 hash: 7e740e87d92d900518db80a3765e821aa5d6623813616e2c72550b579213f16d28441daa5a9a4a3c68df38c3bbdbc102
SHA1 hash: cd87da979087f12606a1ab99b37f1ab9af0d49fa
MD5 hash: 15d0b0f44a40bd7fa1b7118ad81d094d
humanhash: failed-thirteen-lion-michigan
File name:15d0b0f44a40bd7fa1b7118ad81d094d
Download: download sample
Signature Vidar
Create hunting rule
File size:309'285 bytes
First seen:2026-11-13 12:10:48 UTC
Last seen:2026-11-13 12:47:07 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (1'292 x SalatStealer, 78 x BitRAT, 70 x Vidar)
ssdeep 6144:IWGD1VFXWo+A+9bjGDkt4w7CGV/tEpdgkqai/6o/yHbsABG0s+NBUpE:a1VFmHAQu+4wB4pdgUiSo3ABJr
TLSH T10C6423A72BA29F6ACF6EEAF4C1F57470B9920F5FC2BB0114A7DC0DDA183D4244865907
TrID 63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12)
24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.ICL) Windows Icons Library (generic) (2059/9)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter adrian__luca
Tags:exe UPX vidar
File size (compressed) :309'285 bytes
File size (de-compressed) :884'773 bytes
Format:win64/pe
Unpacked file: 9e8144a666abd838ab928f8213313c88967e15a3cd9616c8f011964d6feaa08f

Intelligence

File Origin
# of uploads :
2
# of downloads :
182
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
PEPacker
Details
Link:
https://research.acce.ciphertechsolutions.com/results/62959b43-0919-4ef6-bcfe-839f46eef7f2/
Malware family:
n/a
ID:
1
File name:
a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
Verdict:
Malicious activity
Analysis date:
2026-11-11 20:34:54 UTC
Tags:
telegram evasion
Link:
https://app.any.run/tasks/f37fd761-d061-4c42-ab79-9eda3e8e5212

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99808/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af6fe950a71acf937da6dbd
Tags:
injection stealer agentb virus
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Behavior that indicates a threat
Sending an HTTP GET request
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
Verdict:
Malicious
File Type:
exe x64
Link:
https://opentip.kaspersky.com/a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ee5ba34a-1048-4a64-aaa8-3f66959a0f04
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2005343
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Monitors registry run keys for changes
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2005343 Sample: BW5JtF8lMA.exe Startdate: 13/11/2026 Architecture: WINDOWS Score: 100 96 gm.antres138.org 2->96 98 telegram.me 2->98 100 2 other IPs or domains 2->100 126 Suricata IDS alerts for network traffic 2->126 128 Antivirus detection for URL or domain 2->128 130 Antivirus detection for dropped file 2->130 132 3 other signatures 2->132 8 BW5JtF8lMA.exe 29 28 2->8         started        13 msedge.exe 2->13         started        15 msedge.exe 2->15         started        17 9 other processes 2->17 signatures3 process4 dnsIp5 116 gm.antres138.org 104.21.75.40, 443, 49705, 49817 CLOUDFLARENET-CloudflareIncUS Canada 8->116 118 telegram.me 149.154.167.99, 443, 49703 TELEGRAMVG United Kingdom 8->118 120 miip.live 173.255.202.15, 443, 49826, 49827 AKAMAI-LINODE-APAkamaiConnectedCloudSG United States 8->120 74 C:\ProgramData\7f6d653e0\efe3043d.exe, PE32+ 8->74 dropped 76 C:\ProgramData\7f6d653e0\6db448f5.exe, PE32+ 8->76 dropped 78 C:\ProgramData\7f6d653e0\35f2f964.exe, PE32+ 8->78 dropped 134 Early bird code injection technique detected 8->134 136 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->136 138 Found many strings related to Crypto-Wallets (likely being stolen) 8->138 140 8 other signatures 8->140 19 cmd.exe 8->19         started        21 cmd.exe 8->21         started        23 chrome.exe 1 8->23         started        30 14 other processes 8->30 122 239.255.255.250 unknown ZZ 13->122 80 C:\Users\user\AppData\Local\...\Web Data, SQLite 13->80 dropped 26 msedge.exe 13->26         started        33 2 other processes 13->33 28 msedge.exe 15->28         started        35 2 other processes 15->35 124 127.0.0.1 unknown unknown 17->124 37 2 other processes 17->37 file6 signatures7 process8 dnsIp9 39 efe3043d.exe 19->39         started        42 conhost.exe 19->42         started        44 6db448f5.exe 21->44         started        47 conhost.exe 21->47         started        102 192.168.2.12, 138, 443, 49611 unknown unknown 23->102 49 chrome.exe 23->49         started        104 ax-0002.ax-msedge.net 150.171.27.11, 443, 49787 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 26->104 112 6 other IPs or domains 26->112 106 ln-0007.ln-msedge.net 150.171.22.17, 443, 49799, 49815 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 28->106 108 150.171.28.11, 443, 49803, 49806 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 28->108 114 3 other IPs or domains 28->114 144 Monitors registry run keys for changes 30->144 52 35f2f964.exe 30->52         started        54 chrome.exe 30->54         started        58 11 other processes 30->58 110 142.251.45.193, 443, 49816 GOOGLE-GoogleLLCUS United States 37->110 56 conhost.exe 37->56         started        signatures10 process11 dnsIp12 60 C:\Users\user\AppData\Local\...\googleweb.dll, PE32+ 39->60 dropped 62 C:\Users\user\...behaviorgraphoogleNetworkUpdate.exe, PE32+ 39->62 dropped 64 C:\Users\user\...\ChromeWebProcess.exe, PE32+ 39->64 dropped 66 C:\Users\...\ChromeTaskMonitorService.exe, PE32+ 39->66 dropped 68 C:\ProgramData\...\ChromeUpdateChecker.exe, PE32+ 44->68 dropped 142 Unusual module load detection (module proxying) 44->142 82 www.google.com 142.251.155.119, 443, 49714, 49733 GOOGLE-GoogleLLCUS United States 49->82 84 android.l.google.com 142.251.211.206, 443, 49725, 49729 GOOGLE-GoogleLLCUS Canada 49->84 86 mobile-gtalk.l.google.com 173.194.45.188, 49726, 49762, 5228 GOOGLE-GoogleLLCUS United States 49->86 70 Chrome Cache Entry: 242, PDP-11 49->70 dropped 72 C:\ProgramDatabehaviorgraphoogle\...behaviorgraphoogleUpdate.exe, PE32+ 52->72 dropped 88 172.253.63.188, 49744, 5228 GOOGLE-GoogleLLCUS United States 54->88 90 142.250.217.14, 443, 49763 GOOGLE-GoogleLLCUS United States 58->90 92 142.250.31.188, 49779, 5228 GOOGLE-GoogleLLCUS United States 58->92 94 142.251.157.119, 443, 49752, 49757 GOOGLE-GoogleLLCUS United States 58->94 file13 signatures14
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout UPX UPX Header Tampered Win 64 Exe x64
Link:
https://app.malva.re/file/15d0b0f44a40bd7fa1b7118ad81d094d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5/
Threat name:
Win64.Spyware.Vidar
Create hunting rule
Status:
Malicious
First seen:
2026-11-11 12:07:46 UTC
AV detection:
20 of 38 (52.63%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwx7sicmh26v3kpmlhwlw57pbxl4i6p57w4vd6f3ht3xaoh3r7cq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery upx
Link:
https://tria.ge/reports/261113-pcrdxabt5k/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Reads the TCP/IP host and domain name from the registry
Checks for VirtualBox DLLs, possible anti-VM trick
Checks system information in the registry
UPX packed file
Checks BIOS information in registry
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Malware Family:
n/a
Verdict:
Malicious
Tags:
stealer evasion
YARA:
SUSP_Imphash_Mar23_3
Link:
https://app.threat.zone/submission/c48157db-ce01-401f-901f-4fe1484d8eee
Malware Family:
vidar
Create hunting rule
Malicious:
True
Tags:
exe file-corrupted 64bit file-overlay upx
Link:
https://intel.virussign.com/intelligence/file/a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
Unpacked files
SH256 hash:
a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5
MD5 hash:
15d0b0f44a40bd7fa1b7118ad81d094d
SHA1 hash:
cd87da979087f12606a1ab99b37f1ab9af0d49fa
Detections:
SUSP_Imphash_Mar23_3
Create hunting rule
Link:
https://www.unpac.me/results/bc37ce0d-4d51-4365-a074-7b4d8dce8164/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.82
Link:
https://yomi.yoroi.company/submissions/a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:suspicious_PEs
Create hunting rule
Author:txc
Description:This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.
Rule name:SUSPICIOUS_Potential_DDR
Create hunting rule
Author:NyxIndius
Description:Detects PE files referencing web services potentially used as dead drop resolvers, with network capability correlation for single-indicator cases
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Vidar

Executable exe a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5

(this sample)

Vidar

Executable exe 9e8144a666abd838ab928f8213313c88967e15a3cd9616c8f011964d6feaa08f

  
Delivery method
Distributed via e-mail attachment
  
URLhaus
https://urlhaus.abuse.ch/url/3915327/
Cape
Cape
https://www.capesandbox.com/analysis/99808/
  
Dropping
SHA256 9e8144a666abd838ab928f8213313c88967e15a3cd9616c8f011964d6feaa08f
  
Dropping
MD5 22207c8cc9304136a53b1871c3990978

Comments