MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 9 File information Comments

SHA256 hash:	d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9
SHA3-384 hash:	dd203591191ae57d59c35c71fcd9d430180fe4d720a4901180c09d9595ca8e2379eba8504e798e6a9fe50951328237d1
SHA1 hash:	27f04e55516170d95f8767c989d9ce60528ddcf6
MD5 hash:	31f806662751b5d04144cfcec93cd251
humanhash:	king-east-echo-ink
File name:	eNLe4nm.exe
Download:	download sample
Signature	Vidar Create hunting rule
File size:	588'800 bytes
First seen:	2026-02-27 17:01:36 UTC
Last seen:	2026-02-27 17:42:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fc960b9f00b5c476474282bb39f86c38 (6 x Vidar)
ssdeep	12288:GcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:GcVR9lKocLISavBjR/2S
TLSH	T1FAC42A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec vidar

abuse_ch

UPX decompressed file, sourced from SHA256 aff9e8042ec3a72576b6023c2e732e62b117bb4f785ecbc413c99e47ccfbdff0

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	204'288 bytes
File size (de-compressed) :	588'800 bytes
Format:	win64/pe
Packed file:	aff9e8042ec3a72576b6023c2e732e62b117bb4f785ecbc413c99e47ccfbdff0

Intelligence

File Origin

# of uploads :

# of downloads :

136

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Vidar

Details

Vidar

c2 urls, useragents, c2 handshake magic parameters, a version, and a missionid

Link:

https://research.acce.ciphertechsolutions.com/results/7957eb2a-5701-43e7-81ab-7068bad4b98e/

Malware family:

n/a

ID:

File name:

_d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9.exe

Verdict:

Malicious activity

Analysis date:

2026-02-27 17:09:35 UTC

Tags:

xor-url generic

Link:

https://app.any.run/tasks/a3ec2455-2a93-4286-8463-ab0574fe60cb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/54910/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Vidar.310.22868.3700.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a1ce1a8fffa866e3b2dbcc

Tags:

ransomware obfuscated dropper

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug base64 fingerprint obfuscated

Link:

https://www.filescan.io/uploads/69a1ce169eaae84659404b34/reports/a950e25a-90a0-4784-9eaf-ab6fa54ad1fe/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-02-05T23:38:00Z UTC

Last seen:

2026-02-07T18:12:00Z UTC

Hits:

~10

Detections:

Trojan-PSW.Win64.Vidar.x

Link:

https://opentip.kaspersky.com/d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/ae05d4b7-9a62-49b3-93d3-449ade98b429

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1876091

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect sleep reduction / modifications

Delayed program exit found

Found malware configuration

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to detect virtualization through RDTSC time measurements

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9/

Verdict:

Malicious

Threat:

Trojan-PSW.Win64.Vidar

Link:

https://tip.neiki.dev/file/d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9

Threat name:

Win64.Trojan.Vidar

Status:

Malicious

First seen:

2026-02-06 03:16:52 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 36 (61.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2tofxsdwj6kej2tkbafegcxrak5binidybvnnxlz4cpoj3hhot4q._file

Verdict:

malicious

Label(s):

vidar_2026

Similar samples:

error

Vidar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260227-vj8veshx4g/

Unpacked files

SH256 hash:

d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9

MD5 hash:

31f806662751b5d04144cfcec93cd251

SHA1 hash:

27f04e55516170d95f8767c989d9ce60528ddcf6

Detections:

win_bazarbackdoor_auto

SUSP_XORed_URL_In_EXE

SUSP_XORed_Mozilla

Link:

https://www.unpac.me/results/583a489b-8f32-4660-9786-f3671b7cc618/

Parent samples :

d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9
aff9e8042ec3a72576b6023c2e732e62b117bb4f785ecbc413c99e47ccfbdff0

Malware family:

Vidar

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d4dc5bc8764f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d4dc5bc8764f9444ea6a080a430af102ba143503c06ad6dd79e09ee4ece774f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	sus_pe_free_without_allocation Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution