MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e
SHA3-384 hash:	feef29cc0aac53e8bd3fc4a15e7f157ffdcecd086ba0aa1468efe7e545c9428a278e326c892f338f6ab569cdc9e26a92
SHA1 hash:	ef29d50f8da86571497f32a31dfc40e0eca4844d
MD5 hash:	5c651bd2d6a9c54fcebf9d99791051e9
humanhash:	pip-glucose-alpha-fourteen
File name:	random.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	2'430'976 bytes
First seen:	2025-10-22 12:43:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'861 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:SY0rMsVPXQ1i31lB72lZ73jaHidgapMg8VvXNiyGKFPmsQHLJ:SHMsVsiAZ72HspjGvXUyGKUJJ
TLSH	T133B53387ACB26C5DEDE07F7AED5493E9B2521894188136143C45E4F0948A2F63F713BB
TrID	38.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.6% (.ICL) Windows Icons Library (generic) (2059/9) 15.4% (.EXE) OS/2 Executable (generic) (2029/13) 15.2% (.EXE) Generic Win/DOS Executable (2002/3) 15.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

191

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-10-22 12:43:49 UTC

Tags:

xor-url generic themida

Link:

https://app.any.run/tasks/e45a43e0-ad65-4352-8617-b26b667354e6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/33744/

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68f8d1853edd081eba40ba96

Tags:

emotet cobalt

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Behavior that indicates a threat

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/68f8d1973a79800405f0ebe0/reports/f3a0bbfd-6378-4356-8325-b0d56e39af68/overview

Hybrid Analysis Trojan[Backdoor]/MSIL.Bladabindi

Verdict:

Malicious

Labled as:

Trojan[Backdoor]/MSIL.Bladabindi

Link:

https://www.hybrid-analysis.com/sample/fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-22T10:28:00Z UTC

Last seen:

2025-10-22T12:00:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Spy.Win64.Bobik.gen HEUR:Backdoor.MSIL.Bladabindi.vho

Link:

https://opentip.kaspersky.com/fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/21f5f4e5-73d6-4faf-86fb-b7bb09a9a612

Joe Sandbox Vidar

Result

Threat name:

Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1799795

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Detected unpacking (changes PE section rights)

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Suricata IDS alerts for network traffic

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/5c651bd2d6a9c54fcebf9d99791051e9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e/

Neiki Family.STEALC

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e

ReversingLabs TitaniumCloud Win64.Trojan.Egairtigado

Threat name:

Win64.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-22 12:46:04 UTC

File Type:

PE+ (Exe)

Extracted files:

2

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7rhw323e5imq3i2kccdqrx3vrbyfd6dgxtm224yran2rmlxwxjpa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/251022-pye8rsfj6x/

Behaviour

Checks BIOS information in registry

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/6bea9054-508a-4afb-8a27-c7b22343eb08

UnpacMe

Unpacked files

SH256 hash:

fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e

MD5 hash:

5c651bd2d6a9c54fcebf9d99791051e9

SHA1 hash:

ef29d50f8da86571497f32a31dfc40e0eca4844d

Link:

https://www.unpac.me/results/40f97a0d-0549-4494-a134-5a85853894e5/

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fc4f6deb64ea/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

exe fc4f6deb64ea190da34a108708df75887051f866bcd9ad73110375162ef6ba5e

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3630972/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/33744/