Deep Malware Analysis of f657bbd97cd06f1f89b87262d1b8ed2f | md5: f657bbd97cd06f1f89b87262d1b8ed2f | .Net | PE (Portable Executable) | Stealer | Vidar Stealer | Contains Base64 Block | Base64 Block | Base64 Payload | Html | Executable | PE File Layout | Win 32 Exe | x86 | T1059.001 | T1027 | DeObfuscated | PowerShell

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	f657bbd97cd06f1f89b87262d1b8ed2f
Sha1	f995b7d44a605ae1a8755ab1839a064a25e8611b
Sha256	994e3908823894f612b5081094f2e398f9855bc91297c06182f8a2cee0803484
Sha384	359421ee678e3a8e97c0c67ad343b9f6ff7a07779fe82e54cc041c64a4b1557c4c5429eac2f7a73a9a9494a6fa64374a
Sha512	a7928a0194b8c4c5102c0a8191d8955be16478dcd03d7ae1554c19932a8680d0a98e0e28ec85df1cf0e67006bc25d296bc1833d979e345fb9da3a21b34773118
SSDeep	98304:kMOod9oe/2cX45fmwJ/+fWF4BtpJBv6Aort9BvDCiWfCnOYIRmNEd7ur5TdUD9To:BOrnF4Btq2GOYVBcqy
TLSH	3D4728D2B666A070C9064D7208F7E35613B1AD07DE207561B1CCB72CBFB2697872BD4A

PeID

MASM/TASM - sig4 (h)Microsoft (R) Full-text index fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>scr:ps1~T1027~T1059.001>arc:gz>scr:ps1~T1027~T1059.001

Shape pe:exe>scr:ps1>arc:gz>scr:ps1

malicious 4 nodes

Path pe:exe>enc:b64

Shape pe:exe>enc:b64

2 nodes

Config. Field	Value
C2	https:huhuhuhuhuhuhuhuhuhuhu
Botnet	?Q?xfhuhuhuhuhuhuhuhuhuhuhu
UserAgent	10 huhuhuhuhuhuhuhuhuhuhu
[Configuration Offset]	0x0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
C2	https:huhuhuhuhuhuhuhuhuhuhu
Botnet	J???huhuhuhuhuhuhuhuhuhuhu
UserAgent	Uhuhuhuhuhuhuhuhuhuhuhu
[Configuration Offset]	0x0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
C2	https:huhuhuhuhuhuhuhuhuhuhu
Botnet	??@??huhuhuhuhuhuhuhuhuhuhu
UserAgent	Uhuhuhuhuhuhuhuhuhuhuhu
[Configuration Offset]	0x0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)