MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31
SHA3-384 hash:	543dc7d0439aeb765cdcb0b8f7498204e1411ef04292bad28ed40c18fb561efa75fa96a703867f2748553c8979a38d72
SHA1 hash:	59d35aa1eddd77da3d1bd6550edf10afdd85cf31
MD5 hash:	6f84592e00ee3c67e662992f02dd3683
humanhash:	december-foxtrot-wisconsin-alabama
File name:	MDE_File_Sample_f9eeec54d199f3929309c113730286eb4cbf1527.zip
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	4'148'909 bytes
First seen:	2026-02-17 15:31:26 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: infected
ssdeep	98304:uMoS+5T7WzrMmdJbKacCQCNNY4Zw5JVVarEADM82+:uMxOWzrMiRR1N3w5JVVaJop+
TLSH	T11616338CF1CB7B6211BBA72D53047494211F496C97FA2F6CB5E94DA842CCE8C4A9CCB5
Magika	zip
Reporter	GoBoom
Tags:	bat vidar zip

GoBoom

Dropped by powershell script from russian ip.
It's unknown how the script was started.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

CH

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	w34snw53.bat
File size:	26'579'784 bytes
SHA256 hash:	d48d239fd7fb7f4f9ad3fb2e8b1ef1b6ec62ff3bd05ae0e163f7112edec7be13
MD5 hash:	299774854db41ba228332e01d0cacdbb
MIME type:	text/plain
Signature	Vidar

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ee4f53af-fb91-4c60-a34c-883c8c09907b/

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69948b0a2715406c647aa581

Tags:

shell spawn sage

DocGuard Clean

Result

Verdict:

Clean

File Type:

Bat File

Link:

https://app.docguard.net/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31/results/dashboard

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31/results?tab=lookup

Nucleon Malprob Susipicious

Score:

63%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31/

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31

ReversingLabs TitaniumCloud Binary.Trojan.Generic

Threat name:

Binary.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-17 15:33:40 UTC

File Type:

Binary (Archive)

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vkkdyaxqn4h2abbvl64cvhrkay2c4wtx4m4dcjo46kv7557qjqyq._file

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:vidar loader stealer

Link:

https://tria.ge/reports/260217-s2az1adx7h/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Checks computer location settings

Deletes itself

Detects DonutLoader

Detects Vidar Stealer

DonutLoader

Donutloader family

Vidar

Vidar family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31