Malicious
PE Executable
MD5: 5a810a95985e492b2166d397edcb0e44
Size: 25.4 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
25.4 MB · 25,397,760 B
First seen
2026-09-29 05:30 · 26 days ago
Last seen
2026-09-29 05:30 · 26 days ago
Last analysis
2026-09-29 05:30 · 26 days ago
Hashes
MD5
5a810a95985e492b2166d397edcb0e44
Sha1
4f9a20ea833c73ab0c4e545c269ba17ab3c6f352
Sha256
790a90d32a32e76918851d26c854ef6af63c172c6bbb1f32b70249f451f11c4b
Sha384
19fba26f6ce4c6e12629f39b5b0d917f95e9df1a13e601b18b6f891368403bea9c8e0993fb85e9476efd7cce56b757f7
Sha512
ff2e93e8901f0d4161c570b73b015ec3205a0606715794680075c6e358bf58d72b0da73057913030d48649ad9add637f27c88459e4282ab1caf4c8f5c9bf21e6
SSDeep
98304:V+gF56aBqm/eUQLMHejHD/qF4BW9JBvIAort9BvDCiWfCnOYIRmNEd7ur5TdUD90:8gphF4BWo2GOYVBcqy
TLSH
AE4718D2B666A070C9064D7608F7E35A13B1AD07DE2075A1F1CCB71CBFB2652872BD4A
Detection
PeID
MASM/TASM - sig4 (h)Microsoft (R) Full-text index fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
17 malicious · 19 files
EXE5a810a95985e492b2166d397edcb0e44T1027 · T1059.001Vidar Stealer
Structure
BIN[Base64-Block @0x0056CBDF]
B64[Base64-Block@0x00CBF24C]
PS1[Base64-Block-Decoded]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
GZ[Base64-Block]T1027 · T1059.001
PS1file_0.binT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>scr:ps1~T1027~T1059.001>arc:gz>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:ps1>arc:gz>scr:ps1
malicious
4 nodes
Path
pe:exe>enc:b64
Shape
pe:exe>enc:b64
2 nodes
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ?Q?xfhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | 1 0 huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | J???huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | Uhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ??@??huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | Uhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential