Malicious
Malicious

b025a23eb08722f1d4e7002fd73cf7af

PE Executable
MD5: b025a23eb08722f1d4e7002fd73cf7af
Size: 4.39 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.2 MB PE Executable identified by Malva.RE as Stealer Crypter (stealer loader). Static analysis extracted 41 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027, T1027.001, T1055 and T1140. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0086d2f0a06016855a3e583d436fe63e361c605b0a8780bd6e67a80564700e85
MD5
b025a23eb08722f1d4e7002fd73cf7af
Verdict
Malicious
File type
PE Executable · 4.2 MB
Category
Stealer Loader

Cite this report: https://app.malva.re/sha256/0086d2f0a06016855a3e583d436fe63e361c605b0a8780bd6e67a80564700e85

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
4.39 MB · 4,391,192 B
First seen
2026-10-31 01:30 · 2 days ago
Last seen
2026-10-31 01:30 · 2 days ago
Last analysis
2026-10-31 01:30 · 2 days ago
Hashes
MD5 b025a23eb08722f1d4e7002fd73cf7af Sha1 4d3f96b6826232f16a7b5e4b42f018c457a6f3da Sha256 0086d2f0a06016855a3e583d436fe63e361c605b0a8780bd6e67a80564700e85 Sha384 ed0100dabffd815d28479b2935254f8df1f5ae4b0609971e5483dc2752798a51ef6aef63339bec9a847323b0b3e3924f Sha512 2eac7cb4f00ef880891c38f214a4cdd511e9a199b0420fce1b3e94b1279f7294f70378005741662f0c79693698b35f836bf1f40e42b5aef1bbaa3b121675ce6a SSDeep 49152:H/09O1vS7+Ck8D1oF6Zr0OEK2DbdqoiPJ4yUnwykR56phwg8aSnUIA2lnul:H/d78qNbiPJjUn7PGBaxO0l TLSH 1116CE50FCDB10B5E607593118AB62BF2734AD094F35CAC7E6447B6DED73AE1093222A
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikontElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 42 files
EXEb025a23eb08722f1d4e7002fd73cf7afStealer Crypter
Structure
P7B[Authenticode]_72200e21.p7b
EXEfleetdeck_agent_svc.exe
BINResources
BINRT_ICON
BINID:0003
IMGID:1033
IMGID:1033-preview.png
BINID:0004
IMGID:1033
IMGID:1033-preview.png
BINID:0005
IMGID:1033
IMGID:1033-preview.png
BINID:0006
IMGID:1033
IMGID:1033-preview.png
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
IMGID:1033
IMGID:1033-preview.png
BINID:0009
IMGID:1033
IMGID:1033-preview.png
BINID:000A
IMGID:1033
IMGID:1033-preview.png
BINID:000B
IMGID:1033
IMGID:1033-preview.png
BINID:000C
IMGID:1033
IMGID:1033-preview.png
BINID:000D
IMGID:1033
IMGID:1033-preview.png
BINID:000E
IMGID:1033
IMGID:1033-preview.png
BINID:000F
IMGID:1033
IMGID:1033-preview.png
BINID:0010
IMGID:1033
IMGID:1033-preview.png
BINID:0011
IMGID:1033
IMGID:1033-preview.png
BINID:0012
IMGID:1033
IMGID:1033-preview.png
BINID:0013
IMGID:1033
IMGID:1033-preview.png
BINID:0014
IMGID:1033
IMGID:1033-preview.png
BINRT_GROUP_CURSOR4
BINID:0002
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe~T1027~T1027.001~T1055~T1140>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe~T1027~T1027.001~T1055~T1140>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution
Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. packe (entropie 7.52).
Info
Authenticode present at 0x42DE00 size 8984 bytes

1 malicious · 42 files
EXEb025a23eb08722f1d4e7002fd73cf7afStealer Crypter
Structure
P7B[Authenticode]_72200e21.p7b
EXEfleetdeck_agent_svc.exe
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙