MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 16

Intelligence 16 IOCs YARA 11 File information Comments

SHA256 hash:	db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b
SHA3-384 hash:	fa1e5388614bd214d0f558021073ba41fded74a08b0b7e5ab33b64063603cee505bd45d05517bb3b2dfd1e27d2c95f62
SHA1 hash:	80083f725f6a0e6699da30c3aa1ecca1b96f02bc
MD5 hash:	226641c0ca0ec68b9ef5ee45e5e86b40
humanhash:	georgia-violet-red-social
File name:	file
Download:	download sample
Signature	Vidar Create hunting rule
File size:	1'958'912 bytes
First seen:	2025-12-10 06:01:10 UTC
Last seen:	2025-12-10 11:16:48 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	49152:VL80nI0thT+NpIzalebmOr+aaITdnR6mNgDl:VLznI0tt+NpIzalebmOrXaoR6L
TLSH	T1879512D03A39771ECFA51A30E528DDB542F91DA8B401B9F64ADE3B57B5AC110AE0CF42
TrID	56.5% (.EXE) Win64 Executable (generic) (10522/11/4) 11.0% (.ICL) Windows Icons Library (generic) (2059/9) 10.9% (.EXE) OS/2 Executable (generic) (2029/13) 10.7% (.EXE) Generic Win/DOS Executable (2002/3) 10.7% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 vidar

Bitsight

url: http://178.16.55.189/files/8345013739/vPZ26FE.exe

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

vidar

ID:

File name:

_db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b.exe

Verdict:

Malicious activity

Analysis date:

2025-12-10 06:02:40 UTC

Tags:

stealer stealc vidar xor-url generic

Link:

https://app.any.run/tasks/4272e548-d151-41e4-b1b8-483af224e229

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/44061/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69390cb1bde6a3e5970face2

Tags:

emotet small virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

DNS request

Connection attempt

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Sending a custom TCP request

Sending an HTTP GET request

Behavior that indicates a threat

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

krypt packed vbnet

Link:

https://www.filescan.io/uploads/69390cb064bd958a520f67e9/reports/19a72e68-530c-496c-a366-e9c5724f7414/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-10T03:20:00Z UTC

Last seen:

2025-12-11T08:31:00Z UTC

Hits:

~100

Detections:

Trojan.MSIL.Taskun.sb Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.TCP.C&C Trojan-PSW.Stealerc.HTTP.C&C HEUR:Trojan.MSIL.Taskun.gen VHO:Trojan.MSIL.Convagent.gen

Link:

https://opentip.kaspersky.com/db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/aaee2fcd-4efa-4969-8c24-3ccbe51f01cc

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.46 Win 64 Exe x64

Link:

https://app.malva.re/file/226641c0ca0ec68b9ef5ee45e5e86b40

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b

Threat name:

ByteCode-MSIL.Trojan.Taskun

Status:

Malicious

First seen:

2025-12-10 06:01:21 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3nzoztsn3wvofet2bjijt7gq5agfpiw5q3tdrrb3cpihl3cz54nq._file

Verdict:

malicious

Label(s):

vidar

unc_loader_037

Similar samples:

error

Vidar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:80420c7539f6cc703f53a76218e8be53 discovery spyware stealer

Link:

https://tria.ge/reports/251210-gq169svlds/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of SetThreadContext

Checks installed software on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects Vidar Stealer

Vidar

Vidar family

Malware Config

C2 Extraction:

https://steamcommunity.com/profiles/76561198761022496

Verdict:

Malicious

Tags:

Stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/27b3dfd8-5c98-49c8-9fd0-448ca4b37848

Unpacked files

SH256 hash:

db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b

MD5 hash:

226641c0ca0ec68b9ef5ee45e5e86b40

SHA1 hash:

80083f725f6a0e6699da30c3aa1ecca1b96f02bc

Link:

https://www.unpac.me/results/73fccdc4-2606-4852-9cfd-4d170920eb53/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/db72ecce4ddd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.49

Link:

https://yomi.yoroi.company/submissions/db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834