Malicious
Malicious

0c6c65701bf64f594916956843a0a9af

Share on LinkedIn
Print
HTML
MD5: 0c6c65701bf64f594916956843a0a9af
Size: 7.33 MB
text/html
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0c6c65701bf64f594916956843a0a9af
Sha1 a7a914026be0d1a685a1ed09aa8af16fba2b5ad4
Sha256 9a55efb7b5219b5b9c454d6f462d3c664a9a75808263b5de4fefdd1dfd6c663f
Sha384 4583f3f1d2ada8ea0f27a5caad53dd7877ddecdd0693bbaf1c8b2d6b815faf01bce0c50ec7a572a704d44c687dbae6df
Sha512 36b45f2ce39ec6aff7e8d2d692e6dd54b3bf47325c9bf5a2f22a7e4c7599b9522f7fe3049a45eb599f425ba6b625224d55023bdf715ee4a15c88b0afca92c1c4
SSDeep 49152:MXvGbhGTJQIuL9jKkEWR2bJjLEWcWbSVBKj4rmihMVY7dr6zggQ5+DwKeK9K0ecq:MvTYX2JsTWbIiXsEDecWNVeE
TLSH CA767C13FCA515E9C1AAD23186229153FA717C496B3563D73B50F7282F73BD0AAB9B00
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
0c6c65701bf64f594916956843a0a9af
0x005E3FC8.svg
0x005E3FC8.svg-preview.jpg
0x005FCA53.svg
0x005FCA53.svg-preview.jpg
0x005FD5DB.svg
0x00645F92.svg
0x0064600C.svg
0x00652679.svg
0x00652679.svg-preview.jpg
0x00658DE0.svg
0x0065C5D3.svg
0x0065C6F9.svg
0x0065C6F9.svg-preview.jpg
0x0065C782.svg
0x0065C782.svg-preview.jpg
0x0065C80C.svg
0x0065C80C.svg-preview.jpg
0x00660F9B.svg
0x0066ABD2.svg
0x0068545B.svg
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0000
ID:0
RT_VERSION
ID:0001
ID:1046
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe~T1027~T1055>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Name Value
Attribution
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
PE Detect: PeReader OK (file layout)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙