MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 15


Intelligence 15 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
SHA3-384 hash: bd64b8ab6d8b7171de90584b5c59b8c9c866614468fe9bdf10dda6cf6f685060c4e5a9eca27ccae8ce5f3aeb980ce554
SHA1 hash: e3c1a54775ec27c4fcd66c047dc06573f9ec9d38
MD5 hash: f3c1508784a8783d81099ed498d527c0
humanhash: artist-kilo-bacon-november
File name:f3c1508784a8783d81099ed498d527c0.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:1'639'072 bytes
First seen:2026-07-09 06:50:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 66f1d669875f10b3526b656a280f3f56 (1 x ArkeiStealer, 1 x QuasarRAT, 1 x Vidar)
ssdeep 24576:OJywYd9ywNiYG/LRjH3h4O9Mv0BeV+PJf7gY0cOAEINAlrkSuGVqubD/IahliVl1:OXYd1fOaO6uhf7NNu2
Threatray 40 similar samples on MalwareBazaar
TLSH T12E752393E905ED94D93D86BCA0278E5157B6BE3040584E5EB7A8F03B3F767423123E1A
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 1a3ae6ea62f6cefa (7 x SnakeKeylogger, 2 x RustyStealer, 2 x CobaltStrike)
Reporter abuse_ch
Tags:exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-07-09 06:59:55 UTC
Tags:
auto-startup auto-reg auto-sch stealer stealc vidar loader ip-check evasion rat njrat bladabindi
Link:
https://app.any.run/tasks/9563d7d8-c3cc-4833-9136-fcc2a4bd3511

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74013/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.40356.7898.23778.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4f44f5a900f0e9eb6afa0c
Tags:
injection autorun obfusc remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Launching a process
Creating a process with a hidden window
DNS request
Connection attempt
Behavior that indicates a threat
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a single autorun event
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-09T02:36:00Z UTC
Last seen:
2026-07-09T03:20:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0ab6bb8c-bc6f-4dd0-8df0-ee907b763caf
Result
Threat name:
Quasar, AveMaria, Clipboard Hijacker, Ke
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1939655
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
AI detected suspicious PE / MSI digital signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Check if machine is in data center or colocation facility
Connects to many ports of the same IP (likely port scanning)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Deletes shadow drive data (may be related to ransomware)
Disables zone checking for all users
Drops PE files to the startup folder
Drops PE files with benign system names
Found API chain indicative of sandbox detection
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Quasar
Sigma detected: Schedule system process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AveMaria stealer
Yara detected BrowserPasswordDump
Yara detected Clipboard Hijacker
Yara detected Generic Stealer
Yara detected Keylogger Generic
Yara detected Njrat
Yara detected Quasar RAT
Yara detected StormKitty Stealer
Yara detected VenomRAT
Yara detected Vidar stealer
Yara detected Xorium Stealer
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1939655 Sample: hvME3SFWw1.exe Startdate: 09/07/2026 Architecture: WINDOWS Score: 100 129 ned.omni-signage.com 2->129 131 telegram.me 2->131 133 2 other IPs or domains 2->133 143 Suricata IDS alerts for network traffic 2->143 145 Found malware configuration 2->145 147 Malicious sample detected (through community Yara rule) 2->147 149 38 other signatures 2->149 10 hvME3SFWw1.exe 3 27 2->10         started        15 SecurityHealthService.exe 2->15         started        17 SecurityHealthService.exe 6 2->17         started        19 12 other processes 2->19 signatures3 process4 dnsIp5 135 62.60.226.185, 49717, 49728, 49734 FEMOITGB Germany 10->135 137 ned.omni-signage.com 172.67.140.27, 443, 49706, 49709 CLOUDFLARENET-CloudflareIncUS Canada 10->137 139 telegram.me 149.154.167.99, 443, 49703, 49724 TELEGRAMVG United Kingdom 10->139 99 C:\Users\user\...\SecurityHealthService.exe, PE32+ 10->99 dropped 101 C:\Users\user\...\SecurityHealthService.exe, PE32+ 10->101 dropped 103 C:\Users\user\AppData\Local\...\fbcd6673.exe, PE32 10->103 dropped 111 4 other malicious files 10->111 dropped 173 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->173 175 Found many strings related to Crypto-Wallets (likely being stolen) 10->175 177 Found API chain indicative of sandbox detection 10->177 195 8 other signatures 10->195 21 cmd.exe 1 10->21         started        23 cmd.exe 1 10->23         started        25 cmd.exe 10->25         started        35 3 other processes 10->35 105 C:\Users\user\AppData\Local\...\f101cf63.exe, PE32 15->105 dropped 107 C:\Users\user\AppData\Local\...\e4af4209.exe, PE32+ 15->107 dropped 109 C:\Users\user\AppData\Local\...\88caba81.exe, PE32 15->109 dropped 113 2 other malicious files 15->113 dropped 179 Deletes shadow drive data (may be related to ransomware) 15->179 181 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->181 183 Tries to harvest and steal ftp login credentials 15->183 185 Tries to harvest and steal browser information (history, passwords, etc) 15->185 27 schtasks.exe 15->27         started        187 Multi AV Scanner detection for dropped file 17->187 197 2 other signatures 17->197 29 schtasks.exe 1 17->29         started        189 Antivirus detection for dropped file 19->189 191 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->191 193 Changes security center settings (notifications, updates, antivirus, firewall) 19->193 31 schtasks.exe 19->31         started        33 MpCmdRun.exe 19->33         started        37 3 other processes 19->37 file6 signatures7 process8 process9 46 2 other processes 21->46 50 2 other processes 23->50 52 2 other processes 25->52 39 conhost.exe 27->39         started        41 conhost.exe 29->41         started        54 2 other processes 31->54 43 conhost.exe 33->43         started        56 5 other processes 35->56 58 3 other processes 37->58 dnsIp10 151 Installs a global keyboard hook 43->151 141 ip-api.com 208.95.112.1, 49718, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 46->141 115 C:\Users\user\AppData\Roaming\Chrome.exe, PE32 46->115 dropped 117 C:\Users\user\AppData\Local\Temp\xhjmdw.exe, PE32+ 46->117 dropped 153 Bypasses PowerShell execution policy 46->153 155 Adds a directory exclusion to Windows Defender 46->155 60 powershell.exe 46->60         started        63 powershell.exe 46->63         started        119 C:\Users\user\AppData\Local\...\Dllhost.exe, PE32 50->119 dropped 65 Dllhost.exe 50->65         started        121 C:\Users\user\AppData\Local\Temp\Wihnup.exe, PE32 52->121 dropped 157 Antivirus detection for dropped file 52->157 159 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 52->159 161 Protects its processes via BreakOnTermination flag 52->161 163 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 52->163 68 cmd.exe 52->68         started        70 cmd.exe 52->70         started        123 C:\Users\user\AppData\Roaming\...\Client.exe, PE32 56->123 dropped 125 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32+ 56->125 dropped 127 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32+ 56->127 dropped 165 Multi AV Scanner detection for dropped file 56->165 167 Creates multiple autostart registry keys 56->167 169 Deletes shadow drive data (may be related to ransomware) 56->169 171 4 other signatures 56->171 72 schtasks.exe 56->72         started        74 schtasks.exe 56->74         started        file11 signatures12 process13 file14 199 Loading BitLocker PowerShell Module 60->199 76 conhost.exe 60->76         started        79 conhost.exe 63->79         started        95 C:\Users\user\AppData\...\Java update.exe, PE32 65->95 dropped 97 C:\Users\user\AppData\Local\Temp\Server.exe, PE32 65->97 dropped 201 Antivirus detection for dropped file 65->201 203 System process connects to network (likely due to code injection or exploit) 65->203 205 Multi AV Scanner detection for dropped file 65->205 207 3 other signatures 65->207 81 schtasks.exe 65->81         started        83 Wihnup.exe 68->83         started        93 2 other processes 68->93 85 conhost.exe 70->85         started        87 schtasks.exe 70->87         started        89 conhost.exe 72->89         started        91 conhost.exe 74->91         started        signatures15 process16 signatures17 209 Protects its processes via BreakOnTermination flag 83->209 211 Installs a global keyboard hook 83->211
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/f3c1508784a8783d81099ed498d527c0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ujwd3ah4lgeqm6frvygw3ni2tkjqlhi3vqkzcnhrsswzhsvg2aa._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
Similar samples:
06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949
Vidar
27e3c9b676e96ef69a0043ebf547748ac7189207dc2100cc188ea024be596266
Vidar
41fed20077af837483ffa0560041c9d73a79ce6e2289e752733a0cc02cdf271d
Vidar
4e2e5a9e1f41cd31e084667b68efe7206b78131d6b885bc187254b74ed5f16c3
Vidar
6a2b4d68e0b5367645ec7d108b1146be4fba1f478e75d7d91b52b8f0b636d7d2
Vidar
720a3c7352a4ebaa95565e234fec74865a2dbe4e90e5e9cb308c8575e21f6565
Vidar
7966d3e5e91e05b56dc716f2ec1f0e4cc854b421c1810abbf27941a8fabc3723
Vidar
e438003e81399afda1a4801bdd3d347a757c2068c4dbbaa99d4f554972c546f0
Vidar
error
Vidar
+ 30 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware execution persistence ransomware spyware
Link:
https://tria.ge/reports/260709-hmfa3aex3y/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Drops startup file
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
Unpacked files
SH256 hash:
f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680
MD5 hash:
f3c1508784a8783d81099ed498d527c0
SHA1 hash:
e3c1a54775ec27c4fcd66c047dc06573f9ec9d38
Link:
https://www.unpac.me/results/4be29638-8c4e-402c-82aa-eb4e9f2310fe/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f51361ec07e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings
Rule name:Windows_Trojan_Vidar_57ae970e
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

Executable exe f51361ec07e2cc4833c58d706b6da8d4d4982ce8dd60ac89a78ca56c9e553680

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/74013/
  
URLhaus
https://urlhaus.abuse.ch/url/3881810/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3859771/

Comments