Malicious
PE Executable
MD5: 88136d0f1895e9e4788e43a3279d9cc3
Size: 2.99 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 2.9 MB PE Executable identified by Malva.RE as Vidar Stealer. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- e438003e81399afda1a4801bdd3d347a757c2068c4dbbaa99d4f554972c546f0
- MD5
- 88136d0f1895e9e4788e43a3279d9cc3
- Verdict
- Malicious
- File type
- PE Executable · 2.9 MB
- Family
- Vidar Stealer
Cite this report: https://app.malva.re/sha256/e438003e81399afda1a4801bdd3d347a757c2068c4dbbaa99d4f554972c546f0
Related Vidar Stealer samples
- 39c8c95325a5a1cb68805af3f1aa181a6120fe0732276f43dc309bbe8332c0b1 2026-09-29
- 994e3908823894f612b5081094f2e398f9855bc91297c06182f8a2cee0803484 2026-09-29
- 790a90d32a32e76918851d26c854ef6af63c172c6bbb1f32b70249f451f11c4b 2026-09-29
- b083df8c6bc1f8129547a16b1d0636d81761ab9829fe523add12486196c9c4bd 2026-09-26
- 379f067cc2b638ceb07b704e5cd17fcc9c83bd167a3011f4362d7d2de960580b 2026-09-26
- 9522a0347222b4a2a4adfed4670f0cc99ea4fb6c7ddcd017293fbc29829995bc 2026-09-25
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
2.99 MB · 2,989,424 B
First seen
2026-07-06 10:02 · 3 months ago
Last seen
2026-07-06 10:02 · 3 months ago
Last analysis
2026-09-03 21:12 · one month ago
Hashes
MD5
88136d0f1895e9e4788e43a3279d9cc3
Sha1
15f77ec84529bac93e5e400113c146dc2b9a89ac
Sha256
e438003e81399afda1a4801bdd3d347a757c2068c4dbbaa99d4f554972c546f0
Sha384
429075bca0e8ded7080b31c8a9aff67fb141057cdb4ecac6d6d2ec55add81c6c0a6543fbd5a653b6928c840e6d4a42c5
Sha512
8c51ebd125c0ae787a5e12144e1f6da81bbebbaf35457ec72be0cbf9f0e77a04f705d22e1fab43038303ee0f9ea01ecaf0c9b1adf1ca15e5c20276c538f2187a
SSDeep
49152:efBvSnuJbkXxLP4LMc9iM515RcLTsLIQgzDV:efwNukcEsMQaJ
TLSH
53D58C077CE049E9D8AA93324CB651A27B75BC190F3623D72E60B2782F767D09D36B44
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 2 files
EXE88136d0f1895e9e4788e43a3279d9cc3T1027 · T1055Vidar Stealer
Structure
P7B[Authenticode]_8714742d.p7b
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Info | Authenticode present at 0x2D9400 size 2416 bytes |