Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
The file 19cd01122d9c9162a3780beb3bae3217 is a PE Executable identified by Malva.RE as Stealc (stealer). Static analysis extracted 1 embedded or derived file, a malware configuration (Stealc config. (base64+RC4)) and 1 command-and-control endpoint. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Malicious
- File type
- PE Executable
- Family
- Stealc
- Category
- Stealer
- C2 (defanged)
hxxp://23[.]94[.]252[.]171
Related Stealc samples
All Stealc analyses →Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Packer=UPX Compresor..Gratuito... www.upx.sourceforge.netUPX -> www.upx.sourceforge.netUPX Modified >> *$igBy Ahmed18UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo (overlay)]UPX v1.25 (Delphi) StubUPX v3.0
2 malicious · 2 files
EXE19cd01122d9c9162a3780beb3bae3217Stealc
Structure
EXE[UPX unpacked Nrv2ELe32].exeStealc
Structure
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
malicious
1 nodes
| Config. Field | Value |
|---|---|
| C2 | http:/huhuhuhuhuhuhu |
| Conf. RC4 key | 9vXhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| UPX | UPX method: Nrv2ELe32, filter: X86CallJumpBe |
| UPX | |
CnC
CNCmalicious
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential