Malicious
Malicious

f90824025a235f5f54732ed72e1f4403

PE Executable
MD5: f90824025a235f5f54732ed72e1f4403
Size: 18.46 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 17.6 MB PE Executable identified by Malva.RE as Stealer Crypter (stealer loader). It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027, T1027.001, T1055 and T1140. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
10a41c31e8477506d38a026c926bdbb0f26f398fc39bba406fbcb34b76fd5e5b
MD5
f90824025a235f5f54732ed72e1f4403
Verdict
Malicious
File type
PE Executable · 17.6 MB
Family
Stealer Crypter
Category
Stealer Loader
MITRE ATT&CK
T1027T1027.001T1055T1140

Cite this report: https://app.malva.re/sha256/10a41c31e8477506d38a026c926bdbb0f26f398fc39bba406fbcb34b76fd5e5b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
18.46 MB · 18,458,624 B
First seen
2026-10-27 08:15 · 2 days ago
Last seen
2026-10-27 08:15 · 2 days ago
Last analysis
2026-10-27 08:15 · 2 days ago
Hashes
MD5 f90824025a235f5f54732ed72e1f4403 Sha1 8759f811343bd2b7543a05be6926cbe987dbdd8e Sha256 10a41c31e8477506d38a026c926bdbb0f26f398fc39bba406fbcb34b76fd5e5b Sha384 074c4570e8db62cc5f2ff2c32f6dace46838f5664080a035bf08e4f43ce9fc46b38a5c815166d8022788fcf2a168b78d Sha512 6434a8a386ceaa3ea4b0f69bec208a4641db560cfa7da9ffe14a3d79a84e373f4d568ee6b0cd48c62376f87dc902f9cf7971c2141b6a579347bbfab5f042f300 SSDeep 98304:sWUjIqoP09rcSZVvcECzZfZcRA5RABRolW0ToW1oLEM2Ebk:sXlj7ZJc552C5CBRolWBWXMA TLSH F0077B47F99415E5C0FEC174CAA692227B767C490B306BCB2B50B2786F76BD06E7A310
Detection
PeID
HQR data fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEf90824025a235f5f54732ed72e1f4403Stealer Crypter
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1027.001~T1055~T1140
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Crypter de stealer commodity (imphash multi-familles). Le stealer livre (RemusStealer, Vidar, Stealc, ACRStealer... selon le build) est dechiffre et mappe en memoire : non attribuable statiquement. file-inflation probable (entropie 6.31, taille 18026 Ko).

1 malicious · 1 file
EXEf90824025a235f5f54732ed72e1f4403Stealer Crypter
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙