s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013328 high

📛 Threat Title

Vidar: SHA1 hash of a malware sample (payload) adf03b3cea35bbde094e1b7fbeea6eedd674030a

Category: Vidar Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Vidar. Confidence: 95. First seen: 2026-11-03 16:42:45 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 adf03b3cea35bbde094e1b7fbeea6eedd674030a VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/adf03b3cea35bbde094e1b7fbeea6eedd674030a

IOC database

Type
hash_sha1
Value
adf03b3cea35bbde094e1b7fbeea6eedd674030a
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to Vidar

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/adf03b3cea35bbde094e1b7fbeea6eedd674030a

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Vidar. Confidence: 95. First seen: 2026-11-03 16:42:45 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | Vidar - abuse.ch
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Vidar .

  • MalwareBazaar | vidar - abuse.ch
    web:bazaar.abuse.ch

    Malware samples associated with tag vidar MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with vidar . Database Entry

  • Malware Hash Lookup — Check MD5, SHA-1 & SHA-256
    web:imalware.com

    It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .

  • Hash Checker - File & Malware Hash Lookup | InventiveHQ
    web:inventivehq.com

    Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  • Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
    web:unit42.paloaltonetworks.com

    Static disassembly of the Vidar core payload sample (SHA256 hash : 7ed4a256e1d281cb4f194d13ff554fb280dafde0a67a18115ea038ea6c87d) reveals an in-memory Antimalware Scan Interface (AMSI) bypass that executes before any stealer logic runs. The routine loads amsi.dll, resolves the AmsiScanBuffer variable and overwrites its first six bytes with a patch.

  • Vidar - payload inspection with static analysis
    web:viuleeenz.github.io

    As already mentioned, Vidar payload contains few encrypted strings to slow down the analysis and probably to evade few monitoring solutions. Because of that, there is a function that is in charge to retrieve the plaintext associated with each encrypted string.

  • PDF 202407021700_Vidar Malware Analyst Note_TLPCLEAR - HHS.gov
    web:www.hhs.gov

    The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware . Considering the fact that Vidar—like other stealers—also defaults to performing self-destruction after gathering all the information from the system, it is a rather prolific malware .

  • Vidar Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.

  • PDF Malware Analysis Report Vidar - Stealerware - Quorum Cyber
    web:www.quorumcyber.com

    Executive Summary • Vidar is a strain of "information stealer", or "infostealer", malware , compiled in C++, which collects personal information, private documents, and account data from the devices of infected users. The malware itself is either a fork, or evolution of , the "Arkei" malware variant. Moreover, Vidar malware can be obtained as a " Malware - as -a-Service (MaaS ...

  • Vidar Malware - IOCs, Reports & Analysis (2026)
    web:www.yazoul.net

    Vidar threat intelligence: 2124 samples tracked, 57 daily reports, IOCs, detection rates, and C2 infrastructure. Updated daily from MalwareBazaar.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.