Malicious
PE Executable
MD5: 248977b62d5d3c2961fec8e1c2ed5644
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Vidar Stealer. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 2d3b179077f5a7aea77c70ef7e4219905c2b50680c514e9d3474825fe49f3ce7
- MD5
- 248977b62d5d3c2961fec8e1c2ed5644
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Vidar Stealer
Cite this report: https://app.malva.re/sha256/2d3b179077f5a7aea77c70ef7e4219905c2b50680c514e9d3474825fe49f3ce7
Related Vidar Stealer samples
- 6d68d0a96c8bc726cbe3bf6f6253fb0ccae50627e966b8606f3582ef65eacec7 2026-11-01
- 925a9d35a32e1a6a1ce1ae4b9ff09e289184d4d925d700752c99f15ab04296dd 2026-11-01
- c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc 2026-10-29
- f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c 2026-10-29
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
12.57 MB · 12,570,112 B
First seen
2026-09-11 15:30 · one month ago
Last seen
2026-09-11 15:30 · one month ago
Last analysis
2026-09-11 15:30 · one month ago
Hashes
MD5
248977b62d5d3c2961fec8e1c2ed5644
Sha1
7b8ea5455c89d33ced4a58df77ca50e8d8ac1ce4
Sha256
2d3b179077f5a7aea77c70ef7e4219905c2b50680c514e9d3474825fe49f3ce7
Sha384
a9739e9f8720afb926bc53ba7a6b61134458f688dbb449cf93742943bf34fdf5fc6a47aaead8b73f0799e993239652c6
Sha512
c8807325e8aad02dda2ff6a5b5e283ad2ddc05cc1804321e907d0b03a394d7dcc2a46bcba5bc0d92fac425fc59434a0dfef624a1dc51f5a82b2acd17f80112ad
SSDeep
98304:UGsqTIVri2C3jGdD4/LoAr4i3HVd7EqO/:pTx3jUDsdrTeqO/
TLSH
75C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 1 file
EXE248977b62d5d3c2961fec8e1c2ed5644T1027 · T1055Vidar Stealer
Structure
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055
Shape
pe:exe
malicious
1 nodes