MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b88e9c5d6268063be3dfa3733aeb93eb9b870e0258b14f4053882b06df3ea556. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b88e9c5d6268063be3dfa3733aeb93eb9b870e0258b14f4053882b06df3ea556
SHA3-384 hash:	dd935dabb35ec23a97bb5b26fdfa4d56a3ad97943768714fa34603e1bfd5d2e573ae9bc5703849657a10ab13ac5c7344
SHA1 hash:	51d564af2196128b474143cd340f5cbc3cb84316
MD5 hash:	c1aa4cbccc66b0870e541a4dae47ed8e
humanhash:	saturn-finch-winner-two
File name:	b88e9c5d6268063be3dfa3733aeb93eb9b870e0258b14f4053882b06df3ea556.bin
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	104'421'296 bytes
First seen:	2026-09-03 16:42:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f0ea7b7844bbc5bfa9bb32efdcea957c (160 x Vidar, 68 x Sliver, 35 x RemusStealer)
ssdeep	3145728:LF7hJlMGRq0Tb7ZVHmhbEA7L1NSnDtIyoL:LF7hJKCTb7ZVHmdEA7L1ABIyoL
TLSH	T143382303655452A8C889EB38D1BB427AABB4F8CDE33672875DC274BC6F687E16C35740
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Anonymous
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

229

Origin country :

CH

Vendor Threat Intelligence

ACCE SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/89c87de9-32b4-4b9e-8c72-595470fbe863/

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac8613914cbaa394094f338

Tags:

injection obfusc virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm bloated crypto golang masquerade overlay

Link:

https://www.filescan.io/uploads/6a99a3b9d8153b29b187f123/reports/3e3876a4-db7d-4ec9-8371-704ec1b735dd/overview

Hybrid Analysis W64/WinGo.I.gen

Verdict:

Suspicious

Labled as:

W64/WinGo.I.gen

Link:

https://www.hybrid-analysis.com/sample/b88e9c5d6268063be3dfa3733aeb93eb9b870e0258b14f4053882b06df3ea556

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-03T11:14:00Z UTC

Last seen:

2026-09-04T23:49:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/b88e9c5d6268063be3dfa3733aeb93eb9b870e0258b14f4053882b06df3ea556/results?tab=lookup

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/b88e9c5d6268063be3dfa3733aeb93eb9b870e0258b14f4053882b06df3ea556

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Ravartar

Threat name:

Win64.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-03 16:44:43 UTC

File Type:

PE+ (Exe)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xchjyxlcnaddxy67unztv24t5onyodqclcyu6qctravqnxz6uvla._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/36a01e2f-a71a-4af0-88c1-094b9c60d306

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar botnet:8871af746e869f200c6d738cc0b3bb1d stealer

Link:

https://tria.ge/reports/260903-t8dvxaxxg1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Family: Vidar

Malware Config

C2 Extraction:

https://46.62.133.5
https://telegram.me/nag0e
https://community.fandom.com/wikia.php?controller=UserProfile&method=getUserData&format=json&userId=63727183

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b88e9c5d6268/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.