Deep Malware Analysis of 1fa9c0a151cf3638c103765f158af242 | md5: 1fa9c0a151cf3638c103765f158af242 | Executable | PE (Portable Executable) | Stealer Crypter | Stealer Loader | Commodity Crypter (imphash) | T1027 | T1140 | T1055 | T1027.001 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

7.6 MB · 7,600,128 B

Hashes

MD5 1fa9c0a151cf3638c103765f158af242 Sha1 a2518f469044df9fa50e4f509ee39e673c3d5532 Sha256 26e0644cf7ad60cc0d8aebe5381251eacc124860a969cb5db5c8aab83c86a2b3 Sha384 e6eb7b0f63b6292e3c5105a81d6cee219c55970419e492b14cd0b77bc6cb972ba3cd11e98f6bd2653b2d88b7dcae5717 Sha512 71b78b0a7d88b51c47e5bd7256911a2d3ce760037e737fa41b242801c74966abb906e9e1d6b291db2b712f9bcc8b9085afb4e439bed73669ce84ecda6f9fb6ed SSDeep 49152:uep6lLA4hkJl9CaCegH4ChMzvoIz/JCPSth3MR92d5DUM7X4a3NVtxaGDOjkKCKr:u99mDxCOzr9KEoEoa7DsA2TEo TLSH 88763807ECA558E8C1AED23489769513BF70BC494B3127D71B90F6242F76BE0ADB9384

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file

EXE1fa9c0a151cf3638c103765f158af242Stealer Crypter

Structure

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1027.001~T1055~T1140

Shape pe:exe

malicious 1 nodes

Name Value

Attribution

Name	Value
Attribution	`Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.50, taille 7422 Ko).`
Info	PE Detect: PeReader OK (file layout)

Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.50, taille 7422 Ko).

Info

PE Detect: PeReader OK (file layout)