Malicious
PE Executable
MD5: 45bb36c5efe2113d0ab3c72440c5c0b1
Size: 5.16 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 4.9 MB PE Executable identified by Malva.RE as Vidar Stealer. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 202d6cbb3d1c1f639d388b7bcc6c3f24566eb27f2d5e7fc6520b454e5f868d2c
- MD5
- 45bb36c5efe2113d0ab3c72440c5c0b1
- Verdict
- Malicious
- File type
- PE Executable · 4.9 MB
- Family
- Vidar Stealer
Cite this report: https://app.malva.re/sha256/202d6cbb3d1c1f639d388b7bcc6c3f24566eb27f2d5e7fc6520b454e5f868d2c
Related Vidar Stealer samples
- 6d68d0a96c8bc726cbe3bf6f6253fb0ccae50627e966b8606f3582ef65eacec7 2026-11-01
- 925a9d35a32e1a6a1ce1ae4b9ff09e289184d4d925d700752c99f15ab04296dd 2026-11-01
- c96f81d0ddbc29f0315c4b0809d97e280051a016b6a6852e5bd88e1a6ec235bc 2026-10-29
- f0f686989d043a10a7f5ee442fc97877ac52b9baf16b4cdca1191dd9631efc4c 2026-10-29
- d515d3eeb16636e316345494bf98a312b59bb7f5c226faa6c64ca2e6980f3185 2026-10-28
- 9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
5.16 MB · 5,163,368 B
First seen
2026-09-12 01:30 · one month ago
Last seen
2026-09-12 01:30 · one month ago
Last analysis
2026-09-12 01:30 · one month ago
Hashes
MD5
45bb36c5efe2113d0ab3c72440c5c0b1
Sha1
8a4635c218eb497e220ca3c4f6e98aa477143cc2
Sha256
202d6cbb3d1c1f639d388b7bcc6c3f24566eb27f2d5e7fc6520b454e5f868d2c
Sha384
d38052d3c44e3e1c4928595888e25ff82265175712a520d72a012926334b0653b89fef3219e88aaabb4384a49450b21b
Sha512
1a9436a63da0a8be22f82d385fb2a48a1dc69edf340eaccfd6353db57502b51e4389bb22e4e9b1b1da7b53374b74621dc6ebe1a1951a31646073f6c0c6253170
SSDeep
49152:s/VH67UzaIQ5p/kwzcD4tv4lsJ8naSgcJULPxIf8KA7RkA:sBKV2JMZIf5A
TLSH
FB367B17AE9188F6C1A9E335C8B74245BA64BC0D873123D32E61BE782F723D16E35B54
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 2 files
EXE45bb36c5efe2113d0ab3c72440c5c0b1T1027 · T1055Vidar Stealer
Structure
P7B[Authenticode]_528e2a7a.p7b
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Info | Authenticode present at 0x4EC000 size 2408 bytes |