Deep Malware Analysis of ab1801280f0266457be50d78ac198581 | md5: ab1801280f0266457be50d78ac198581 | Vidar | Go Loader (Factory-v3) | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ab1801280f0266457be50d78ac198581
Sha1	c9a2b5bb3d4207a283568eaced5616aa90317930
Sha256	bb6afa93514e75276745b5ee7aaf8308d1dabe2ac40f1a1dbec76d0db48066a4
Sha384	dbbb5163cf723c80e889b39dd52ef9a8437ded79ba0af75009aaecf06c52aaf13ac389f74812f9f49a746ad1466f6d95
Sha512	7f720cf6bc23769d8fd12a55823372afda858656d26185f96f09ef6657818aaa75b7816c4cd94a97ae67a483d948fc4dbb421df4919857f25da364040f53f55d
SSDeep	98304:8zYVHM+bb+qdF8pklF5NUzCt2kslgyGIVsCCCHYeAA2dAZlMwJU:8sHM+bb+qdF8pkP5NUW2kslbGI4Q2WrU
TLSH	5C766C0BBF9541A8C01AEA35C5A79212FA717C8CCB3473EB5E9061342E367D26DB5F24

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x700200 size 8104 bytes