Malicious
Malicious

7c899a22fc45dd962a559893d1deedee

Share on LinkedIn
Print
PE Executable
MD5: 7c899a22fc45dd962a559893d1deedee
Size: 5.58 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.3 MB PE Executable identified by Malva.RE as Stealer Crypter (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027, T1027.001, T1055 and T1140. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
904c4e2668168f89d0a2b49e205bbc4aee947e44c71871dd58ac401e2f191471
MD5
7c899a22fc45dd962a559893d1deedee
Verdict
Malicious
File type
PE Executable · 5.3 MB
Family
Stealer Crypter
Category
Stealer Loader
MITRE ATT&CK
T1027T1027.001T1055T1140

Cite this report: https://app.malva.re/sha256/904c4e2668168f89d0a2b49e205bbc4aee947e44c71871dd58ac401e2f191471

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
5.58 MB · 5,580,216 B
First seen
2026-10-27 22:30 · 2 days ago
Last seen
2026-10-27 22:30 · 2 days ago
Last analysis
2026-10-27 22:30 · 2 days ago
Hashes
MD5 7c899a22fc45dd962a559893d1deedee Sha1 9cf98ed9e4f22c6d092e9e6e3e4511360eeafcf5 Sha256 904c4e2668168f89d0a2b49e205bbc4aee947e44c71871dd58ac401e2f191471 Sha384 79dee244de55c4583792517e86b0f7b4771f4ed9b64c3c567361680dcf4c96947d39ff620f234ea4aa68a4bfe8ad55d7 Sha512 f124802d0c9333c770a3d761e4891cb8b98efbd518e5c8afcd4f25c42e945932a69736cb4715582e788ecfd5b6113fdde2731f567705328b0c6d914f62ad20f1 SSDeep 49152:gnjsZ2p1zELLE2mukLaF2Yb7kBhoLG/cVWOixA1H3WjpqkhTS:21SwukWWPwUtS TLSH AD463A03BA9042E8D0A9EE34C5BA9113BA747C8C8B3563EB1D6176342F75BD06DB6F14
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE7c899a22fc45dd962a559893d1deedeeStealer Crypter
Structure
P7B[Authenticode]_cfa052e9.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1027.001~T1055~T1140>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.13, taille 5449 Ko).
Info
Authenticode present at 0x550600 size 8120 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙