Malicious
Malicious

Setup.exe

Share on LinkedIn
Print
PE Executable
MD5: 5b737aa5f272e04dc22a5c1acbc7db74
Size: 5.54 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

The file Setup.exe is a 5.3 MB PE Executable identified by Malva.RE as Stealer Crypter (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027, T1027.001, T1055 and T1140. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1a461f91f62661bf469c00061c447c16f1137a097edbe651b295b6628e716363
MD5
5b737aa5f272e04dc22a5c1acbc7db74
Verdict
Malicious
File type
PE Executable · 5.3 MB
Category
Stealer Loader

Cite this report: https://app.malva.re/sha256/1a461f91f62661bf469c00061c447c16f1137a097edbe651b295b6628e716363

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
5.54 MB · 5,538,744 B
First seen
2026-10-27 19:42 · 2 days ago
Last seen
2026-10-27 19:42 · 2 days ago
Last analysis
2026-10-27 19:42 · 2 days ago
Hashes
MD5 5b737aa5f272e04dc22a5c1acbc7db74 Sha1 2e3199dd2e911613cbb2a534a963a7f799de3389 Sha256 1a461f91f62661bf469c00061c447c16f1137a097edbe651b295b6628e716363 Sha384 8c0430a08aa48256fa87e3099d6f2ea1113effd7ab20e64363579c6a2e99f1a06a0599f260c04be00b57f4d8cee53df8 Sha512 2b26e0f9e166b3487e84ee5496137f90dfc46309eda3d1b742743e7455ea4814a5444e2eb3178608c94bf5f6f99dd598a65ef6662d905b605922d7dec83b1fbc SSDeep 49152:va/07DqciC3ldwqBRCORqkpUzw34gVyl9oW3dl2RDk:rMCvFzqNy4kyvoon TLSH 9F463B437A9042D8D0A5EA34C57A9213BA787C8C8B3163FB1D6176742F76BC07EB6B14
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXESetup.exeStealer Crypter
Structure
P7B[Authenticode]_b530ba08.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1027.001~T1055~T1140>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution
Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.14, taille 5408 Ko).
Info
Authenticode present at 0x546400 size 8120 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙