MB-0da518a8446bf832d527a9859d96753b6740f9ae1991e0ca72c928f3fc46dec7
high
📛 Threat Title
Unknown: gitlосitу64-v.6.866.exe
Description
File type: exe. Size: 5895120 bytes. Tags: exe, signed, Stealer, Vidar, VidarStealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:04:54.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_imphash
d42595b695fc008ef2c56aabd8efd68e
IOC database
- Type
- hash_imphash
- Value
d42595b695fc008ef2c56aabd8efd68e- First seen
- Last seen
- Attached to this threat
- Appears in
- 891 threats
- Description
- imphash of URLhaus payload a7b9f3dda435b7f2…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
0da518a8446bf832d527a9859d96753b6740f9ae1991e0ca72c928f3fc46dec7
IOC database
- Type
- hash_sha256
- Value
0da518a8446bf832d527a9859d96753b6740f9ae1991e0ca72c928f3fc46dec7- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
adf03b3cea35bbde094e1b7fbeea6eedd674030a
IOC database
- Type
- hash_sha1
- Value
adf03b3cea35bbde094e1b7fbeea6eedd674030a- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
dd40a776e6ca00d9ca8bd3cb06e2b8b7
IOC database
- Type
- hash_md5
- Value
dd40a776e6ca00d9ca8bd3cb06e2b8b7- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 5895120 bytes. Tags: exe, signed, Stealer, Vidar, VidarStealer. Reporter: AmadeyHunter. First seen: 2026-11-02 23:04:54.
Remediations (9)
-
web:learn.microsoft.com
Here are a few steps you can take to try to identify and deal with the unknown app in Windows 11: Check Task Manager: Right-click on the taskbar and select Task Manager. Look for any unfamiliar processes in the Processes tab. Right-click on these processes and select Open File Location to determine their source. Scan for malware:
-
web:learn.microsoft.com
I'm running into a problem with securing windows 11 23r2 systems and wanted to know if there is a workaround for the following issue: Security Context: CVE-2013-1609 CVE-2014-0759 CVE-2014-5455 Nessus found the following service with an untrusted…
-
web:malwaretips.com
This guide teaches you how to remove Unknown .exe virus for free by following easy step-by-step instructions.
-
web:ones.com
Found an unknown program in Task Manager Startup? Use this proven checklist to identify and act on suspicious startup entries. Read now to secure your PC.
-
web:support.microsoft.com
Learn how to run Windows Update Troubleshooter to resolve errors downloading or installing Windows updates.
-
web:www.experts-exchange.com
If you work on vulnerability patching and remediation , there are new issues constantly arising. Recently, one called "Windows Unquoted/Trusted Service Paths Privilege Escalation" started showing up. In most cases, this is a mid-level vulnerability, but it still needs to be resolved. In most cased, the application and path are different for various servers, so this makes correcting via a ...
-
web:www.malwarebytes.com
A fake Microsoft support website is tricking people into downloading what looks like a normal Windows update. Instead, it installs malware designed to steal passwords, payment details, and account access. Because the file looks legitimate and avoids detection, it can slip past both users and security tools. A very convincing Windows update We spotted the campaign at microsoft-update [.]support ...
-
web:www.microsoft.com
A malware campaign uses WhatsApp messages to deliver VBS scripts that initiate a multi-stage infection chain. The attack leverages renamed Windows tools and cloud-hosted payloads to install MSI backdoors and maintain persistent access to compromised systems.
-
web:www.microsoft.com
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.