MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2bd45c96cdf7faf05f3180ecc74e23ef60d1eea86850178d653d7a265381d99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c2bd45c96cdf7faf05f3180ecc74e23ef60d1eea86850178d653d7a265381d99
SHA3-384 hash:	d75fce0a3ad62cb7a5bf87aa110a6af9abf2c9a39df06c3dd2273499a50b49cf2192f9362a0791b6e5575ef6b7d4f480
SHA1 hash:	115065a896a252195da5ab7f48b9b0235ec18da1
MD5 hash:	14f3e9dd56087f4e93d2435eaa8e8372
humanhash:	mockingbird-mars-lake-cold
File name:	c2bd45c96cdf7faf05f3180ecc74e23ef60d1eea86850178d653d7a265381d99.bin
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	102'396'336 bytes
First seen:	2026-09-13 14:44:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ebc247a77b4d4a804b261f97a1fd075c (106 x Vidar, 32 x RemusStealer, 26 x Smoke Loader)
ssdeep	1572864:QX/+Qs4LW0TeIzmzZgQTqu+veaW7yhy/mgzieh3EWoj99EvA/TdxZJ72S7CFL2:aGVMFTxzmzZUTGn7v/mA/i9GIb9h2SY2
TLSH	T10F282303EE1524E9C46DD770CDABA6673B71B8484B3123C71E64FA342E2A7C4AD79B44
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Anonymous
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

214

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 crypto golang masquerade overlay packed

Link:

https://www.filescan.io/uploads/6aa6b6c64ee4fa3b72f0de66/reports/932da9cc-d9cd-4be7-a78d-5df7af6f73c7/overview

Hybrid Analysis Win64/GenKryptik.HUFD trojan

Verdict:

Suspicious

Labled as:

Win64/GenKryptik.HUFD trojan

Link:

https://www.hybrid-analysis.com/sample/c2bd45c96cdf7faf05f3180ecc74e23ef60d1eea86850178d653d7a265381d99

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-13T08:58:00Z UTC

Last seen:

2026-09-13T11:12:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/c2bd45c96cdf7faf05f3180ecc74e23ef60d1eea86850178d653d7a265381d99/results?tab=lookup

Nucleon Malprob Susipicious

Score:

58%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/c2bd45c96cdf7faf05f3180ecc74e23ef60d1eea86850178d653d7a265381d99

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-13 14:45:37 UTC

File Type:

PE+ (Exe)

AV detection:

4 of 36 (11.11%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yk6ulslm35726bptdahmy5hch33a2hxkq2cqc6gwkpl2ezjydwmq._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/e533a108-11df-4f5d-962e-4e6136daef56

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/260913-r4dm8syama/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Checks for VirtualBox DLLs, possible anti-VM trick

Checks system information in the registry

Checks BIOS information in registry

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c2bd45c96cdf/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.