Malicious
baf9cea14437b586c05d0aea2082fc43
PE Executable
MD5: baf9cea14437b586c05d0aea2082fc43
Size: 156.16 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
156.16 KB · 156,160 B
First seen
2026-07-15 07:31 · 3 months ago
Last seen
2026-07-15 07:31 · 3 months ago
Last analysis
2026-09-03 21:26 · one month ago
Hashes
MD5
baf9cea14437b586c05d0aea2082fc43
Sha1
433599cf52b16e3c0ebc675ad69abba671af421d
Sha256
c2665146924371e34157e249c8e05b276c52de7280f4b895923dc21b636dfe0f
Sha384
7b1f9c00341d7446a90b3d64cebe07baaccb9cca867184936ff70b9036dbb64a04d0d0fcb8c7d2a125f05059aa2c2c45
Sha512
f93bdbd04d2d87ac8533c205cab8745fbb7fccaf9bb2825dc168854f87fe72c3016d6b3c96ce75837e2aad56e2f584b0745e2eb4e603e72b89686c760fc205ca
SSDeep
3072:vEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTfavXUowv+F9OerHJvX:c3h0aMJ+Hw3Pgen79/Svk9yb1
TLSH
38E38D193B93D472E5492B78227F37BCDEB08D362C50CAEBDF80290E4E671905796267
Detection
PeID
Microsoft Visual C++ v6.0 DLL
1 malicious · 7 files
EXEbaf9cea14437b586c05d0aea2082fc43Vidar Stealer
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINRT_GROUP_CURSOR4
BINID:0000
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
No STICH Path has been generated for this analysis yet.
1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
1| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | PDB Path: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb |
1 malicious · 7 files
EXEbaf9cea14437b586c05d0aea2082fc43Vidar Stealer
Structure
BINResources
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account