Malicious
Malicious

58697f112739d5bc33a49972be3c53d8

PE Executable
MD5: 58697f112739d5bc33a49972be3c53d8
Size: 5.04 MB
application/x-dosexec

This sample is a 4.8 MB PE Executable identified by Malva.RE as Vidar Stealer. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d22cc704e023241be25b289ab0814ccbb8d0e224f443cf163457b157129a0257
MD5
58697f112739d5bc33a49972be3c53d8
Verdict
Malicious
File type
PE Executable · 4.8 MB
Family
Vidar Stealer
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/d22cc704e023241be25b289ab0814ccbb8d0e224f443cf163457b157129a0257

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
5.04 MB · 5,043,560 B
First seen
2026-08-11 14:17 · 2 months ago
Last seen
2026-08-11 14:17 · 2 months ago
Last analysis
2026-09-03 21:08 · one month ago
Hashes
MD5 58697f112739d5bc33a49972be3c53d8 Sha1 991e5521c0971fa85ba823853e1bbd9667b70b9f Sha256 d22cc704e023241be25b289ab0814ccbb8d0e224f443cf163457b157129a0257 Sha384 f586b660fde28aa84a12f8f653b209ca9b68621411b9c50dd2483b51da27a0267c4ddd3aa825b144ead60ba4fca67388 Sha512 f3a0905d632f42cf7317d8a78eb2eafda00f64115a8c28fd82f8270f5bab193b0f8d6c3a207e2fb477a3bbfeeaff6109c467661c606b03d3ba91e9b88babdc53 SSDeep 49152:he8nbLrTrJbAezFlHkTW9uGCRBYNg39C+8P0yPaDLExkNE7OyVtNY+e8xs9+hgKX:hvlRlIRuNg39CJPPPeLExH TLSH 35368C176E9048F5C099E331C87762197AB0B80D8B3137D32E55AE782F727C2AE79B54
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE58697f112739d5bc33a49972be3c53d8Vidar Stealer
Structure
P7B[Authenticode]_45b31aea.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x4CEC00 size 2408 bytes

1 malicious · 2 files
EXE58697f112739d5bc33a49972be3c53d8Vidar Stealer
Structure
P7B[Authenticode]_45b31aea.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙