🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c
SHA3-384 hash: aedce21c42f44a799e524a7ca94a0bd59d7782828bc8a2d1c5c324973b91e9656364ab7bed20a9eb5a1bf23dd099f0b3
SHA1 hash: 008a64efd96b1a92cd182fd3523d44e348b07fba
MD5 hash: 138ca7a6667d8347b236f2aacb134e09
humanhash: queen-four-mike-lactose
File name:b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:104'387'464 bytes
First seen:2026-10-05 16:14:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash c2d457ad8ac36fc9f18d45bffcd450c2 (74 x Vidar, 38 x RemusStealer, 24 x CobaltStrike)
ssdeep 1572864:92wzaSFSf4tUSvR5g9AK+gEkB0VKbnJyPe6wKEHi9f5XSL5D9Zkw:SfyJg/iK7GePKEHeXGPkw
TLSH T18B381217768840DCC54BD3B084B05D3A16B13CAE9632FB8F4EE96E941F167D96FA8B04
TrID 34.1% (.EXE) Win64 Executable (generic) (6522/11/2)
23.5% (.EXE) Win32 Executable (generic) (4504/4/1)
10.7% (.ICL) Windows Icons Library (generic) (2059/9)
10.6% (.EXE) OS/2 Executable (generic) (2029/13)
10.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Kejult
Tags:exe stealer vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
314
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bloated crypto golang overlay
Link:
https://www.filescan.io/uploads/6ac3ccf283c3e97b4f40c782/reports/0ad2c3ae-f791-456f-8a25-15b1df5eb7fa/overview
Verdict:
Malicious
Labled as:
WinGo/GenKryptik.HUIK trojan
Link:
https://www.hybrid-analysis.com/sample/b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-05T14:12:00Z UTC
Last seen:
2026-10-06T20:27:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c/results?tab=lookup
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c
Gathering data
Threat name:
Win64.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-10-05 16:15:47 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wakokhrq4njgrgz2funiwtyqb2x4tvzhhmwyjdtfl3v2auj6g5oa._file
Verdict:
malicious
Label(s):
Vidar
Create hunting rule
Link:
https://reports.threatray.com/024c5721-4465-400e-a270-6920402190cc
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:3c00c1c71b68375e8e113e02d184e22d defense_evasion discovery stealer
Link:
https://tria.ge/reports/261005-tp24dsyz6r/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Reads the TCP/IP host and domain name from the registry
Checks for VirtualBox DLLs, possible anti-VM trick
Checks system information in the registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Family: Vidar
Malware Config
C2 Extraction:
https://172.238.117.154
https://telegram.me/bj00tyr
https://steamcommunity.com/profiles/76561198630398488
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b014e51e30e3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:SUSPICIOUS_Potential_DDR
Create hunting rule
Author:NyxIndius
Description:Detects PE files referencing web services potentially used as dead drop resolvers, with network capability correlation for single-indicator cases
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe b014e51e30e352689b3a2d1a8b4f100eafc9d7273b2d848e655eeba0513e375c

(this sample)

  
Delivery method
Distributed via web download

Comments