MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865
SHA3-384 hash:	0cfb5eb20c942a1838dcc2c7e03c93745f49774881cdd210c13f1ce170af0a72cfd01facd3155fba960ecef516d49b4f
SHA1 hash:	8517ac69f351f77fa5fc90026b218e02a0518143
MD5 hash:	57eb2fe435d796d1337cc09d84a5d2c6
humanhash:	alanine-beer-floor-rugby
File name:	c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865
Download:	download sample
Signature	Vidar Create hunting rule
File size:	18'944 bytes
First seen:	2026-08-10 13:24:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	11efe8447ae3f5354583e730cc5c17c7 (1 x Vidar)
ssdeep	384:OJvEmCcL2iPA9bOSQ0iYN4D8gxuLIsBjYli:UvaBBiTxuja
TLSH	T1E6826145E15B9AE4C4E1C337636A429755F8BC2432725A7B6BDCAB2A4D42330F7502EC
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe vidar

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/79489/

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Searching for synchronization primitives

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

microsoft_visual_cc mikey

Link:

https://www.filescan.io/uploads/6a79d1629319687c8f7be98d/reports/acc5c697-3a2f-43f1-addd-f87e19b4348c/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-06-28T10:48:00Z UTC

Last seen:

2026-07-17T03:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5d4b233b-ef39-42ba-b8d7-9a4c4f625a94

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865/

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-06-28 15:40:15 UTC

File Type:

PE+ (Exe)

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yz5ujlaxkzzgj3ux3hk6jl2uphg2pdqdbvnermpntadyunm5rbsq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260810-qpz29aaj41/

Unpacked files

SH256 hash:

c67b44ac17567264ee97d9d5e4af5479cda78e030d5a48b1ed98078a359d8865

MD5 hash:

57eb2fe435d796d1337cc09d84a5d2c6

SHA1 hash:

8517ac69f351f77fa5fc90026b218e02a0518143

Link:

https://www.unpac.me/results/a97ecc05-b6ba-4c6e-894b-8ea467ad0d39/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.