Deep Malware Analysis of efa5e99ce97dc17bdf168e4c6bbccdba | md5: efa5e99ce97dc17bdf168e4c6bbccdba | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | Vidar Stealer | Go Loader (Factory-v3) | T1027 | T1055

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	efa5e99ce97dc17bdf168e4c6bbccdba
Sha1	204f62f579dd5c7f2d281a0e648c2f3a9f80775e
Sha256	00219a6c610d02c63721e8521c70c9086fdbf566205dcac489f1904f11377218
Sha384	37f64fb24037af3df570bab385a4280c109f03512d60a5a2db0a2e272d1132e35faede5b550be2fadf6eda0f82b9bdc8
Sha512	0843e0e1187ece6701f844e01c66a6641a6850059ac57c7f60f2f697fb0d125b59edf60a2232f6932dea372a95684c4d8d1b4e4b2a6d66cbfa51ecae6bf4e047
SSDeep	49152:BAqv4AUqpOZYud0CqpSbWGK1GQj5Hdh3xK0MmWmZhwPTcmqyqvtlMUL7UxtBeb8f:BAPX4bWcxcSHEG+EYKb91aDWdLxFbu
TLSH	8D268E07BDA25975C48BA2368D7212407768BC4B4B3A33E32EA0E6753F737C18A75B54

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x45F388 size 2384 bytes