MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 14


Intelligence 14 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0
SHA3-384 hash: 51ca16e671c5e88e78be99cf6e925394d455fca7df65cdf766e1e856f91ed6f1a68202108e4c79df28821f69727c5a69
SHA1 hash: 8b8f384d9784a72d9cec80989a24c4d4283b6bd9
MD5 hash: 2a645a619d4a682df7366b2f712c74b8
humanhash: wisconsin-twelve-neptune-july
File name:SecuriteInfo.com.Win32.Vidar-B.44722646
Download: download sample
Signature Vidar
Create hunting rule
File size:427'520 bytes
First seen:2025-09-12 16:17:34 UTC
Last seen:2025-09-13 04:14:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e5924a272fbee5c04c949a96084fe740 (1 x Vidar)
ssdeep 6144:2AGClj2F3uvDM9z6u1K9FSc/9UkzHagMqu6m1pOeOqY4/eq6KH3V0+aZ/An2w:Bj2eDM9QBzHVMqu605L2qNIc
TLSH T12794172553AB0A96F423DC398013C737D6B1BA6283D0A66BD374DB6D2F13923996DF04
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe vidar

Intelligence

File Origin
# of uploads :
10
# of downloads :
188
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.Vidar-B.44722646
Verdict:
Malicious activity
Analysis date:
2025-09-12 16:18:14 UTC
Tags:
stealc stealer vidar
Link:
https://app.any.run/tasks/df9202b1-d874-4c9e-b15e-04051bb2cd78

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27223/
Detection(s):
SecuriteInfo.com.Win32.Vidar-B.44722646.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c447e6d49ea3f1e4b4b716
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Behavior that indicates a threat
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm base64 cmd crypto evasive fingerprint hacktool lolbin microsoft_visual_cc rundll32 stealer
Link:
https://www.filescan.io/uploads/68c447e2b29d966a312b8c40/reports/d30c10ba-4a41-4941-8245-8b4f57206ca7/overview
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-12T12:38:00Z UTC
Last seen:
2025-09-12T12:38:00Z UTC
Hits:
~100
Detections:
VHO:Trojan-PSW.Win32.Vidar.gen Trojan-PSW.Stealerc.HTTP.ServerRequest Trojan-PSW.Stealerc.HTTP.C&C Trojan-PSW.Win32.Vidar.sb Trojan-PSW.Win32.Stealerc.sb Trojan-PSW.Win32.Stealerc.ren Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.TCP.C&C PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d5c582cc-41dd-4ba2-a4ac-8564e2394573
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/2a645a619d4a682df7366b2f712c74b8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0
Threat name:
Win64.Trojan.Doina
Create hunting rule
Status:
Malicious
First seen:
2025-09-12 15:56:01 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vodkhn47ktz7t4xy465alxsbf4tzfx4zzpvobkxldcq7xml277ya._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250912-tr9w1swn19/
Verdict:
Suspicious
Tags:
stealer vidar Stealc
YARA:
EXE_Vidar_May_2024
Link:
https://app.threat.zone/submission/21003a79-291b-44f9-aad0-da3799d2b0a3
Unpacked files
SH256 hash:
ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0
MD5 hash:
2a645a619d4a682df7366b2f712c74b8
SHA1 hash:
8b8f384d9784a72d9cec80989a24c4d4283b6bd9
Link:
https://www.unpac.me/results/ed40ddb8-82e7-4281-8a34-4830fc0df6cf/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ab86a3b79f54/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:gcleaner
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked gcleaner stealer malware samples.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Vidar_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe ab86a3b79f54f3f9f2f8e7ba05de412f2792df99cbeae0aaeb18a1fbb17afff0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3622680/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/27223/
  
URLhaus
https://urlhaus.abuse.ch/url/3623010/

Comments