Deep Malware Analysis of f2662d8ddaa38e648c7b331e2568ebec | md5: f2662d8ddaa38e648c7b331e2568ebec | Vidar Stealer | Go Loader (Factory-v3) | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	f2662d8ddaa38e648c7b331e2568ebec
Sha1	a1e7bb38f43baf8a6c7300a4cc73d34133ba18e9
Sha256	4ef2b2638d87670790c999a61136c25449b4e0a3ab83929f88054c499e85619a
Sha384	793361389ef1764a3411e41e1f8e7ca70cf52875a05d263657b9d56cfe0e7f4fa62e481e11668897784dbb0c9ffd442c
Sha512	3686e18ba21dbc7300017d0f240a8cd6a1aa386ea78edc897ec97258a335193dc3e1460f3044488117b2bdcbf551fb79a14e343e612dd77bcd04f048410eabbf
SSDeep	49152:WFklDT/uQkck/7Tgr5jAt5mzP68YR66qUMAM+iM5FOZ30TMqcuzrBexKcK9KJERV:WCYeAizybJqxM5Fk0TMv4rCE+s
TLSH	B5567B17FD9108E9C0DAA23189A79252BB71BC494B3223D72FA0B7782F727D06D78754

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12Private EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x5AEA00 size 2432 bytes