Malicious
malva_img_62286fdfc7fc4996856e2c591bac1ae1.bin
HTML
MD5: 2d98445783055f16fa6c4a8975fa859a
Size: 5.24 MB
text/html
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
5.24 MB · 5,243,360 B
Hashes
MD5
2d98445783055f16fa6c4a8975fa859a
Sha1
0297f81ad921d5291ca6ae200491b4f0a4b10b27
Sha256
f211c45c2dd508734dbd84d088e08848f116a978c2c3982260b4122c5785e47b
Sha384
9af55c694bab2e5bfc5b347d5fefb45cd5725a9730034180444f9dd61b7bdea06ba774efa8ce0a7fb55c82d3b7033c25
Sha512
b5d4668f9c1d44a30075605f2f9c59f1d05fce99a8b1d9fc91e15298441f842db0cffc5489c0491ae89c67e2c6dd68d2353cbcf23002ccac630040c7eaabafaa
SSDeep
49152:1S6Xv29C6EqOK6BePTbHvaxZP4IFkHo9irX2KPR8YzqU5x:1Sav8O9cKBAvP6G75x
TLSH
19361942EFD48212E3F35B3194BB87619B31FC41B921CF1F2258EA1DAD31B90AD91766
Detection
PeID
ASProtect v1.2 -> Alexey Solodovnikov (h1)Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12PeStubOEP v1.xPolyEnE 0.01+ -> Lennart HedlundPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team
1 malicious · 2 files
HTM2d98445783055f16fa6c4a8975fa859aVidar Stealer
Structure
BIN[Base64-Block @0x00112099]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
1 nodes
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | F��huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | :expirhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ��� ��huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | t����huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ������huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | �� ?�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ile(BZhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | v + "\huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ?D$?huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | ?\??#huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| VHD | DiscUtils extraction failed (ArgumentOutOfRangeException) for VHD. |
| VHD | DiskImage extraction mode: RecursiveExtractor fallback (VHD) |
| Info | PE Detect: PeReader OK (file layout) |
1 malicious · 2 files
HTM2d98445783055f16fa6c4a8975fa859aVidar Stealer
Structure
BIN[Base64-Block @0x00112099]
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | F��huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | :expirhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ��� ��huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | t����huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ������huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | �� ?�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ile(BZhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | v + "\huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ?D$?huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | ?\??#huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.