Deep Malware Analysis of 2aad0c2944754979c4ea0b0d0461efed | md5: 2aad0c2944754979c4ea0b0d0461efed | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | Vidar Stealer | Go Loader (Factory-v3) | T1027 | T1055

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	2aad0c2944754979c4ea0b0d0461efed
Sha1	2477cbaf09aff57e538eb9a98ded675e23ca53a0
Sha256	863866fa9ffff1dd6e4d7bba34f127c9847e444078203fd2490a16fa08e91b92
Sha384	1ca8bf9074f6db75ae6b8e4f5062a5c692d7248668afe17b4b8a992175d14c59ca5ae5e88ea8dc26d8843a168a833827
Sha512	36526063c5cf7c1c91d8d17cb938f8e867cf073a9a9a5e647509f44c3f600ecb4d130ca97e6d10ea5dcb0d749ae9be5ae75b77c71fb610c5f22e20d487752e99
SSDeep	49152:AhzEBkE3cwYogSe2gGDhQLAPSfdWePdpIAyStSoH81TndbfkQHmVE5JEYmEP6RZ8:AYUvJUSRVQGz86RZ88
TLSH	F1667C07BD6505B9C0A99630C4B75253BB787C8E8F3173E32E50A6782F76BD069BA704

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x66C000 size 8120 bytes