Deep Malware Analysis of cede917005058b4c75682694354b3c46 | md5: cede917005058b4c75682694354b3c46 | Executable | PE (Portable Executable) | Stealer Crypter | Stealer Loader | Commodity Crypter (imphash) | T1027 | T1140 | T1055 | T1027.001 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

11.81 MB · 11,810,304 B

Hashes

MD5 cede917005058b4c75682694354b3c46 Sha1 6d7a8909520bd5df04c39438063cde734d31ddba Sha256 bdc6af65b3c5c5d2519e0a2798f9445a522806ded006a3c8c0134e481dbb5692 Sha384 f1cbef83b862c37178b2db62ee46f05cc23141f16ad3fb9ca7046bf5f3e137dd8997281572e52c50367c67f2738fdd29 Sha512 985e5d83d61c0f7848503941fa89a37eef45617061ba6127839aa0a18e4cc1cda32c9ac3792c03123ede0a90924025ec0afb6e384dead3fc7acb0fa98b0dc482 SSDeep 196608:tPftGlpclSD4sHtmNLHI5PtCca/S5FcnTRwxhTSOP21iCgf6N:tHQpMTsHtmlHIqca65eTRwPSOmiC+q TLSH C1C6AE03ECA515E5C0ADD6318A639622BB617C895B3123D72B90F3252F77BD0BEB9350

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file

EXEcede917005058b4c75682694354b3c46Stealer Crypter

Structure

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1027.001~T1055~T1140

Shape pe:exe

malicious 1 nodes

Name Value

Attribution

Name	Value
Attribution	`Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.40, taille 11533 Ko).`
Info	PE Detect: PeReader OK (file layout)

Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.40, taille 11533 Ko).

Info

PE Detect: PeReader OK (file layout)