Malicious
7e8864b2bc5ffc30a24e4eaf1abe9e67
VBScript
MD5: 7e8864b2bc5ffc30a24e4eaf1abe9e67
Size: 25.4 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
25.4 MB · 25,397,760 B
First seen
2026-09-29 05:30 · 26 days ago
Last seen
2026-09-29 05:30 · 26 days ago
Last analysis
2026-09-29 05:31 · 26 days ago
Hashes
MD5
7e8864b2bc5ffc30a24e4eaf1abe9e67
Sha1
1752bafacf004114f0a3046f0711b2de309837ea
Sha256
39c8c95325a5a1cb68805af3f1aa181a6120fe0732276f43dc309bbe8332c0b1
Sha384
71fe8f63085cfa44b8d016b18dd139ed2094be8546e5575a749e53d34808cf770b8dca6a745b9436ef36f9a6abd39887
Sha512
dd1c661380cd62431b487d3a9e1df9c5b33ad1db149356831212a645ede488d4ac8f2ba7d7f53e9a3b66772881689f0f0bf9aa9e16dc653f15e79ce2275ea822
SSDeep
98304:7nHXmSTs/2ke29h9gucrUwF4BiqJBv3Aort9BvDCiWfCnOYIRmNEd7ur5TdUD9TV:rHrZF4Bii2GOYVBcqy
TLSH
9F4728D1B666A070C9074D7208F7E35A13B1AD07DE207561B6CCB72CBFB2652872BD4A
Detection
PeID
MASM/TASM - sig4 (h)Microsoft (R) Full-text index fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
17 malicious · 19 files
VBS7e8864b2bc5ffc30a24e4eaf1abe9e67T1027 · T1059.001Vidar Stealer
Structure
BIN[Base64-Block @0x0056CBDF]
B64[Base64-Block@0x00CC0DDF]
PS1[Base64-Block-Decoded]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
GZ[Base64-Block]T1027 · T1059.001
PS1file_0.binT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>scr:ps1~T1027~T1059.001>arc:gz>scr:ps1~T1027~T1059.001
Shape
pe:exe>scr:ps1>arc:gz>scr:ps1
malicious
4 nodes
Path
pe:exe>enc:b64
Shape
pe:exe>enc:b64
2 nodes
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ?Q?xfhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | 1 0 huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | J???huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | Uhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ??@??huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | Uhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential17 malicious · 19 files
VBS7e8864b2bc5ffc30a24e4eaf1abe9e67T1027 · T1059.001Vidar Stealer
Structure
BIN[Base64-Block @0x0056CBDF]
B64[Base64-Block@0x00CC0DDF]
PS1[Base64-Block-Decoded]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
GZ[Base64-Block]T1027 · T1059.001
PS1file_0.binT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ?Q?xfhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | 1 0 huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | J???huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | Uhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ??@??huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | Uhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account