Stealer Crypter malware analysis – 095aaaa3cd9b

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

1.69 MB · 1,686,456 B

First seen

2026-10-25 11:00 · 12 hours ago

Last seen

2026-10-25 11:00 · 12 hours ago

Last analysis

2026-10-25 11:03 · 11 hours ago

Hashes

MD5 675a7ad76f67d05d1f05be24b7f70db3 Sha1 8e7469900ad9b5ba4140fc2bdcb76c4957d996a5 Sha256 095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6 Sha384 95bc943fca4d021261be0540dc0392eb19e556899566f4db83829305078d1b03f92bc6f8ff97a8c85ade861364df5fc2 Sha512 123acd2e53307e9053523c0ae515de44d033626b986f051ab40198aed14031d602792c7f9ba012462d940f80ebb1dae7ea36e781959d3a6679d184c24f2485f5 SSDeep 49152:uv/CSU/SKSc36O+W7cB0ICGS476COxKrkzv:uxYSA36Gc6u6COKW TLSH 3875232217F844A6D875133594B697A38230794B7B39DE9F2399D89D3F63AC0B03835B

Detection

PeID

Microsoft Visual C++ 8.0 (DLL)

8 malicious · 73 files

A3X675a7ad76f67d05d1f05be24b7f70db3Stealer Crypter

Structure

P7B[Authenticode]_c8aaf1db.p7b

BINResources

A3XRenewal.au3

A3Xaut9444.tmp.tok

A3X[Cleaned].au3

A3X[Deobfuscated].au3

A3X[Deflattened].au3

BIN[Payload 1 hex].bin

BIN[Payload 2 b64].bin

EXEAutoIt3.exe

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

8 / 8

Path pe:exe~T1027~T1027.001~T1055~T1140>pe:rsrc>pe:autoit>pe:exe>bin

Shape pe:exe>pe:rsrc>pe:autoit>pe:exe>bin

malicious 5 nodes

Path pe:exe~T1027~T1027.001~T1055~T1140>pe:exe>pe:rsrc>bin

Shape pe:exe>pe:exe>pe:rsrc>bin

malicious 4 nodes

Name Value

Attribution

Name	Value
Attribution	`Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. packe (entropie 7.96).`
Info	Authenticode present at 0x199200 size 10680 bytes
Info	PDB Path: wextract.pdb

Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. packe (entropie 7.96).

Info

Authenticode present at 0x199200 size 10680 bytes

Info

PDB Path: wextract.pdb

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential