Deep Malware Analysis of 0061df69c06c63b227ebdc548de974ce | md5: 0061df69c06c63b227ebdc548de974ce | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0061df69c06c63b227ebdc548de974ce
Sha1	fdd0dbffafe1af11bead9099a5629027d9bb53b3
Sha256	3213b549b2cd92d22e7153a5f360cea1e3f0f018c45ebf43310d074ddf97b6bc
Sha384	3c200b026b86f69c1119407ed2959a81316211e3f3df6c709f259c8579bcbb141e516a3609697077972be4f10faf64b5
Sha512	e17fb641dda4eebcdd7b8406e3efa609a326dda7c3d212035743be6460eac10917668a3d7c2f72c643eafb45e72793bac1c0d27b112f24284d9306f38d3d23ee
SSDeep	98304:ogAYfHuGvKAEa+4XKBzHJQ1tbgLDJiVoEOWSEL:oWHXKdHJmsLDkV8W/
TLSH	1CC64A43E8A545E8C0AED175CA269227BBB17C884B3463D36B50F7242F77BD0AE79704

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)