MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be24b9eb3fcfb9671aeaacbb24a4f413daf9abd24b41a9ee390caeec74200af6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	be24b9eb3fcfb9671aeaacbb24a4f413daf9abd24b41a9ee390caeec74200af6
SHA3-384 hash:	5dbfac1d3a8fc1f17d05ab6f7eacbb3eb05c5cb286e76d92c85c1d4b4a5877ed3b1c5403f7b42d7095bf1e9b6b02edc0
SHA1 hash:	e3604f005b288e09ea7b93b87a8384591f494083
MD5 hash:	31eb16dd4d90cca749b2c140512b20c6
humanhash:	undress-magnesium-blossom-three
File name:	XenoUI_v7.55.436.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	98'154'944 bytes
First seen:	2026-10-26 13:42:29 UTC
Last seen:	2026-10-26 14:25:17 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	4f2f006e2ecf7172ad368f8289dc96c1 (184 x SalatStealer, 76 x Vidar, 46 x RemusStealer)
ssdeep	1572864:lWoGfNDUNEjAaJToSQTKIu1xJ5Kg2pXQ/UXwgs1awEbnsSKZfymfmiUzI+OWjxVW:lOxEIoNoL5Kg2pXQ1awtZH8IMyZo2
TLSH	T14D283303BDA091F8C5AAC638C6675123BAB4BC8CD73572973E0069743FA5BD05BB9B44
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	smica83
Tags:	exe HUN vidar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

238

Origin country :

FR

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN vidar

Malware family:

vidar

Alert

Create hunting rule

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-26 16:45:10 UTC

Tags:

stealer vidar

Link:

https://app.any.run/tasks/af47b2f0-9fef-4254-a591-06f3e9fd97b3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adf5901afb06e650cd93130

Tags:

n/a

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating synchronization primitives

Connection attempt

Sending a custom TCP request

Launching a service

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm bloated crypto golang overlay

Link:

https://www.filescan.io/uploads/6adf58f90357eedc2f3934db/reports/3d473b44-09df-40b6-893f-e5dd28a2e59d/overview

Hybrid Analysis WinGo/Kryptik.AEM trojan

Verdict:

Malicious

Labled as:

WinGo/Kryptik.AEM trojan

Link:

https://www.hybrid-analysis.com/sample/be24b9eb3fcfb9671aeaacbb24a4f413daf9abd24b41a9ee390caeec74200af6

Joe Sandbox Vidar

Result

Threat name:

Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1991988

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Early bird code injection technique detected

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Suricata IDS alerts for network traffic

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Unusual module load detection (module proxying)

Uses the Windows Restart Manager Abuse for Browser Credential File unlocking

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/be24b9eb3fcfb9671aeaacbb24a4f413daf9abd24b41a9ee390caeec74200af6

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-26 10:27:17 UTC

File Type:

PE+ (Exe)

AV detection:

7 of 36 (19.44%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xyslt2z7z64wogxkvs5sjjhucpnptk6sjna2t3rzbsxoy5babl3a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

discovery

Link:

https://tria.ge/reports/261026-q1ewfsft3p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Reads the TCP/IP host and domain name from the registry

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.