MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 16 File information Comments

SHA256 hash:	abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f
SHA3-384 hash:	d8e946eeb03a910b1abc6716559fc9d31cdb94dc9fe9ea5479e6f536bbe2bd64d2e0043c173f46409336e3acb901c41c
SHA1 hash:	74567b016f0101c7a46b924f362cec4245dcd443
MD5 hash:	952268f60dcb35d273babb0d87ef77bb
humanhash:	island-ceiling-north-pennsylvania
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	3'724'800 bytes
First seen:	2025-09-05 04:01:20 UTC
Last seen:	2025-09-09 04:04:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8cd0ffc23a93d40428f4277ead307c71 (5 x LummaStealer, 2 x Stealc, 1 x Rhadamanthys)
ssdeep	49152:EQkSbazOng5cqPGK5fjTJkyYJYI7SmpcC5buk3PZH87w4:1bazOgWqPbfRKJimv5bH3xcl
TLSH	T12D069D19FC36D18AECE38071BF39D211D5622E37DF2C226B91DC89900555DEEB62E07A
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe vidar

Bitsight

url: http://178.16.55.70/v3434.exe

Intelligence

File Origin

# of uploads :

# of downloads :

136

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

NewTextDocumentmod.exe.bin.exe

Verdict:

Malicious activity

Analysis date:

2025-09-04 17:20:35 UTC

Tags:

xred backdoor loader hausbomber delphi telegram lumma stealer snake keylogger evasion auto coinminer miner dyndns amadey botnet stealc python vidar gcleaner purecrypter rat asyncrat remote antivm github quasar metasploit framework generic ultravnc rmm-tool banker grandoreiro websocket sparkrat discord autoit exfiltration smtp ms-smartcard ims-api rdpwrap meterpreter payload purelogs prysmax pyinstaller xmrig uac hijackloader tool salatstealer

Link:

https://app.any.run/tasks/24b6a2db-c6b6-4aa7-9060-da1642d1925c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/25129/

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ba609eeb163e0ec184646e

Tags:

emotet virus agent sage

Result

Verdict:

Clean

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint krypt microsoft_visual_cc packed unsafe

Link:

https://www.filescan.io/uploads/68ba609d20d0ee406d95fbeb/reports/12f42e69-4482-45e2-bd91-8040621df227/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-09-04T23:44:00Z UTC

Last seen:

2025-09-04T23:44:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Win32.Vidar.sb Trojan-PSW.Win32.Stealerc.sb Trojan-PSW.Win32.Stealerc.rcu Trojan.Win32.Inject.sb PDM:Trojan.Win32.Generic VHO:Trojan-PSW.Win32.Convagent.gen

Link:

https://opentip.kaspersky.com/abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/2049cb26-8138-4cd8-9383-b3a4522f6150

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/952268f60dcb35d273babb0d87ef77bb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-09-04 16:56:44 UTC

File Type:

PE+ (Exe)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vpew4kndilkxm3okls3zduf2soh3s3nyfplnqwd3w53sfvopijxq._file

Verdict:

malicious

Label(s):

vidar

Result

Malware family:

xworm

Score:

10/10

Tags:

family:asyncrat family:lumma family:njrat family:quasar family:vidar family:xworm botnet:chrome botnet:default botnet:hacked credential_access defense_evasion discovery execution persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/250905-elgwqavwdz/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Executes dropped EXE

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Downloads MZ/PE file

Uses browser remote debugging

Async RAT payload

AsyncRat

Asyncrat family

Detect Vidar Stealer

Detect Xworm Payload

Lumma Stealer, LummaC

Lumma family

Njrat family

Quasar RAT

Quasar family

Quasar payload

Vidar

Vidar family

Xworm

Xworm family

njRAT/Bladabindi

Malware Config

C2 Extraction:

178.16.55.70:6000
https://limcuz.ru/wotr
https://mastwin.in/qsaz
https://noggs.ru/yopd
https://georgej.ru/plnb
https://oneflof.ru/tids
https://epitherd.ru/zadw
https://backab.ru/lkdo
https://eigwos.ru/wqex
https://kimmenkiz.ru/zldw
178.16.55.70:5552
178.16.55.70:4449
178.16.55.70:4782

Verdict:

Suspicious

Tags:

Stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/a57fb026-440a-4c5a-9a48-30eac5a8ba13

Unpacked files

SH256 hash:

abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f

MD5 hash:

952268f60dcb35d273babb0d87ef77bb

SHA1 hash:

74567b016f0101c7a46b924f362cec4245dcd443

Link:

https://www.unpac.me/results/4eec3542-b74d-434e-9847-d2f2bb12ad3c/

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/abc96e29a342/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	gcleaner Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked gcleaner stealer malware samples.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Vidar_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe abc96e29a342d5766dca5cb791d0ba938fb96db82bd6d8587bb77722d5cf426f

(this sample)

Dropped by

Amadey

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3615435/

Cape

https://www.capesandbox.com/analysis/25129/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample