MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aed369919e5f5044598997297544de11d1184993eea935f6bafc65b51436c8dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 6

Intelligence 6 IOCs YARA 26 File information Comments

SHA256 hash:	aed369919e5f5044598997297544de11d1184993eea935f6bafc65b51436c8dc
SHA3-384 hash:	6c1a746d6f8eb6faf0858f8f7e4927b2d47cd2ffdb6b85dc17db8ca88f49ece1ea4f0a86aace3c325e926cbee85837c7
SHA1 hash:	155867ce10fc8d5fc3f48f78f5055605d19ce824
MD5 hash:	4be2b217e1cdc07a904c2c1644734dfd
humanhash:	friend-mockingbird-nebraska-nuts
File name:	Howard.exe.zip
Download:	download sample
Signature	Vidar Create hunting rule
File size:	4'733'854 bytes
First seen:	2025-02-13 20:26:12 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:XAiukWAKKA5EbN771fcAcwjh/qyek2jLjeaNtsGpH3ilWrjBpp:QGxA5ET1iH1BNeGfBb
TLSH	T1092612AC74B5BA5AF6D4437BC6812CB6DB2CB480D7993D9B8E2001567D8320E5F3B871
Magika	zip
Reporter	SI_FalconTeam
Tags:	file-pumped piratefi vidar zip

SI_FalconTeam

Vidar stealer distributed via Steam game "PirateFi". C2: opbafindi[.]com

Intelligence

File Origin

# of uploads :

# of downloads :

456

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Howard.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	531'073'568 bytes
SHA256 hash:	65fb800ffd674f60ebe7e54164f3e41545651c0a37ed67bbf97d72cef894ed6d
MD5 hash:	e3202e70c2d8aecf0347f85c4fb39032
De-pumped file size:	2'711'552 bytes (Vs. original size of 531'073'568 bytes)
De-pumped SHA256 hash:	80a2df6d67c251c6ae13dae5e9189500f9f22ed52928e6484082413ccf9e14db
De-pumped MD5 hash:	262dfb3c2333afb399b1a384fa65bdeb
MIME type:	application/x-dosexec
Signature	Vidar

Vendor Threat Intelligence

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ae558128ab76d43a5adc7e

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/aed369919e5f5044598997297544de11d1184993eea935f6bafc65b51436c8dc/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Suspicious

Labled as:

HEUR/Pumpar.Generic

Link:

https://www.hybrid-analysis.com/sample/aed369919e5f5044598997297544de11d1184993eea935f6bafc65b51436c8dc

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/aed369919e5f5044598997297544de11d1184993eea935f6bafc65b51436c8dc

Score:

10%

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cerberus Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	Cerberus

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	GuLoader Create hunting rule

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM usernames

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Stealc_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Stealc Payload

Rule name:	Suspicious_Latam_MSI_and_ZIP_Files Create hunting rule
Author:	eremit4, P4nd3m1cb0y
Description:	Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Telegram_Links Create hunting rule

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	unknown_dropper Create hunting rule
Author:	#evilcel3ri
Description:	Detects an unknown dropper

Rule name:	Vidar_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Vidar Payload

Rule name:	Warp Create hunting rule
Author:	Seth Hardy
Description:	Warp

Rule name:	WarpStrings Create hunting rule
Author:	Seth Hardy
Description:	Warp Identifying Strings

Rule name:	weird_zip_high_compression_ratio Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects single-entry ZIP files with a suspiciously high compression ratio (>100:1) and decompressed size above the 500MB AV limit
Reference:	https://twitter.com/Cryptolaemus1/status/1633099154623803394