Go Loader (Factory-v3) malware

This Go-based loader family (factory-built, version 3) decrypts and maps a second-stage payload in memory, typically a commodity information stealer. The final payload is not present in clear in the loader.

Malva.RE has analysed 285 public samples tagged Go Loader (Factory-v3), statically and without execution. The latest public sample was seen on 2026-10-26.

File types

PE Executable40

Latest public Go Loader (Factory-v3) samples

Sample	Type	First seen
288c5d9cfe8fb7f7ccb99f29f76552164efbcec38d6856d8674bf4d24e783a4c	PE Executable	2026-10-26
15c64ba71c39dae1862eb9b9f2e4bd663d2e941494aaf05e9c84e9594d299c1d	PE Executable	2026-10-26
46844618d9458479f7a069a43c236747dde8d0f8d636b348f42bcb8e545f3213	PE Executable	2026-10-26
ecda1ecc579e7b586528d1d94c33060e4aca1c0444ae0550cd488defe00320a3	PE Executable	2026-10-26
079b45c4e8697b39d50229d6013b31ecf01e5fc83684f99d688e2d5a3c5a2c9b	PE Executable	2026-10-26
c5c58cd2c7f577f6d7a10109dfd9813cead6e75b2bf94637c1e82cdf0147a8d5	PE Executable	2026-10-26
dd50a17845f8c0cc2d08afadb32dc7ff299e5abe4ecac5fa750b0be69fed6090	PE Executable	2026-10-26
497b509fcf854d0d468365f770a8441a4f4bcf40486a8a3448fb3d087c9fbb50	PE Executable	2026-10-26
2bb931569546cef66ee1b018b3aa73bcbf80fd7edfa6c6fe52b7d1b172dbcbcd	PE Executable	2026-10-26
f7a3ed9ae1030d442c757a6d69bd4bc8b97fbbd15ad58145683f878e4ac97aa7	PE Executable	2026-10-26
95861be8cf7bf7388393380e25b5352e9541154ff8a6eb060aedb4ce6b0c73bc	PE Executable	2026-10-26
30fcf9503d67566e01c98ef03dfa55b1681f43e8e709a0e51284fd9e27c13d5b	PE Executable	2026-10-26
7084a4f940d61ecf2fc588fd325321663ad975cda129a9fbfa317378e2a97af6	PE Executable	2026-10-26
02d28f8a8cc5f0598f67d2d664b92607162d8f01fbd9fc37fc353e675e0568cb	PE Executable	2026-10-26
9db3010318c6e4392a9c1038ad2445ff01414279f576f484b6f21b5ce7739dc9	PE Executable	2026-10-26
f4a4bfe0a3724f5ddb5c9c78a208e72be3fa77bdbde8836901e26a714e98c741	PE Executable	2026-10-26
53d3e583edfa14a1ab7decf5b5c5d36ead371350a9c71fd6650c0e3e9a1081c5	PE Executable	2026-10-26
60458b413968640bee146326da9c15113de5a0bc5b7cf114b0505e82f8e9468a	PE Executable	2026-10-25
570b9f31bb5d10de0307c3d2e3368cf9025c40a225c5fc12c6292fe9f1a79644	PE Executable	2026-10-25
b4f328e743406d1410d5d534d03d0fe3ac279b068e5e9929ec4392f958b68cd3	PE Executable	2026-10-25
fc7263c84c0940ea0d84606061381f41d03b9688676efc3d1a23686d1660054d	PE Executable	2026-10-25
38dd7a38a1b94ccc005e932b436d7c30eb150baef95cea698b34c0a6dc9a4baa	PE Executable	2026-10-25
9408db00acd90d71170035776dab4472bb7455067db0cf23f2af2670e2087a11	PE Executable	2026-10-25
7f0f2ea6ab1b7c745e5ebac6838f3c144aa1b9e1a503374857d03c614848de6a	PE Executable	2026-10-25
a8ab3f140bc9879b4cebc95a69fe008fbbf013d1a6ee8718f13db9c8d238afe7	PE Executable	2026-10-25
aa218700505cffd034b70167b96501e1904cc570c31a08b270c6dec6df2d679a	PE Executable	2026-10-25
e6945197d44d1c8c0651f5523cbd0ff70362fc9922d75221415fc3d0ceacb5a0	PE Executable	2026-10-25
eedc9b027a45decbb871c6042f65cfdd114cfa2e0ea4b9bbc37c663cd4d1d1a1	PE Executable	2026-10-25
ecb214f6e697f2aa82d62a7eeb7782ee7427afd2a302f4664b2c177fd53af328	PE Executable	2026-10-25
ed267508f076d8f0ae1e77b13cbdc359ce25d9345407367f8af991194a052019	PE Executable	2026-10-25
19be9a2a6d5cc73e036dc52c02234b79584482600f92244077ff6eb03122019b	PE Executable	2026-10-25
0f7df63cb33760ecfc28a0528f1063565c321547a5aa5a3252289cecf3ea65a7	PE Executable	2026-10-25
802479118edbe27d31a7d1ae2b16e6a3dc78ba32f34737a4940028060719787d	PE Executable	2026-10-25
a1aafc1c9c85a77b366d242c2dbd77d7a6de95107a474919ad04dee6cca636b4	PE Executable	2026-10-25
bd09b40e5dceb4e0fa422e57f8754bb6ec679b94194177f92e472875fb1d4d8d	PE Executable	2026-10-25
baaadd859d1ab4142442003a80681dfa8ac306038de626f383e0110fd656c3b4	PE Executable	2026-10-25
ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39	PE Executable	2026-10-25
6ce1361c8184bc6d53a7546036d612998853504082f58aa902cdac3661791c19	PE Executable	2026-10-25
a30d635253a77444c38cf25d439bb96cd913fd16b9d1d40898cb9014f4f43831	PE Executable	2026-10-25
fa43e663995e393a5a66f63c1e9c4b700f5c1812aa91b992a4c48d9f748e12b8	PE Executable	2026-10-25

Analyse your own Go Loader (Factory-v3) sample

Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.

Analyse a file for free