Malicious
Malicious

6c9aaeb054947e40b22cf9e893d4f395

PE Executable
MD5: 6c9aaeb054947e40b22cf9e893d4f395
Size: 501.76 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 490 KB PE Executable identified by Malva.RE as Vidar Stealer (stealer). Static analysis extracted 1 embedded or derived file and a malware configuration (Vidar Config. Remote Dll Download #1, Vidar Config. Remote Dll Download #2, Vidar Config. Remote Dll Download #3). It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a7a8ae48cf1e994fe864246cc26361aaec0f7ba58a37e27a11ee51d041c9f75e
MD5
6c9aaeb054947e40b22cf9e893d4f395
Verdict
Malicious
File type
PE Executable · 490 KB
Family
Vidar Stealer
Category
Stealer

Cite this report: https://app.malva.re/sha256/a7a8ae48cf1e994fe864246cc26361aaec0f7ba58a37e27a11ee51d041c9f75e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
501.76 KB · 501,760 B
First seen
2026-11-03 14:45 · 3 hours ago
Last seen
2026-11-03 14:45 · 3 hours ago
Last analysis
2026-11-03 14:45 · 3 hours ago
Hashes
MD5 6c9aaeb054947e40b22cf9e893d4f395 Sha1 4ad2a626efd879c8e8666b2026b0d2942daebe11 Sha256 a7a8ae48cf1e994fe864246cc26361aaec0f7ba58a37e27a11ee51d041c9f75e Sha384 cb10b62fbdf24a916f1d2c7fccd12c60f70df8d7e6af756cf4b03fe4de6c2a09706a918baa11e9be6091982154fd9849 Sha512 03613e1604faa4fe9614d88691fdf368536e8f77944e2a437d8b699044feb41ce083738cdad6a7736462585e0bf4263743a9be76d3130c452ab48cac606a6335 SSDeep 6144:LvldXdjY3NwrKcYs8Ses/t3HqlQzMA/P9uKmSkPbwaTxhAc/vL3ID4GStoBKF/PW:rlMNwmcvxaHA/l5E3/D5+B+BelXcOJp TLSH A5B45C36A6A8217CE167C1BCDED35802E6B2BC460330AADF23D059B71F179E4567EB11
Detection
PeID
Microsoft Visual C++ 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL

1 malicious · 2 files
EXE6c9aaeb054947e40b22cf9e893d4f395Vidar Stealer
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ������huhuhuhuhuhuhuhuhuhuhu
UserAgent ������huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet seed��huhuhuhuhuhuhuhuhuhuhu
UserAgent ������huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ������huhuhuhuhuhuhuhuhuhuhu
UserAgent ������huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Info
PDB Path: t$di

1 malicious · 2 files
EXE6c9aaeb054947e40b22cf9e893d4f395Vidar Stealer
Structure

Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ������huhuhuhuhuhuhuhuhuhuhu
UserAgent ������huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet seed��huhuhuhuhuhuhuhuhuhuhu
UserAgent ������huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
C2 https:huhuhuhuhuhuhuhuhuhuhu
Botnet ������huhuhuhuhuhuhuhuhuhuhu
UserAgent ������huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset] 0x0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙