Deep Malware Analysis of 01ab970e35894f7aae5974d16799d75d | md5: 01ab970e35894f7aae5974d16799d75d | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64 | PDB Path

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

4.13 MB · 4,128,624 B

Hashes

MD5 01ab970e35894f7aae5974d16799d75d Sha1 c618d443aa71463824b4b302ae2c097e256362d1 Sha256 a58c639a10831e63e3cd237614d5c7b7a52eecdc576cfd2ec37d3ccaf3caa6e7 Sha384 f76b63a9115e86b763f7bf76d506a51af4133c1fa27e278bf399d6f9147b577544cb5853862d9d63afc6b7d6e476d4f4 Sha512 9c62f9c3e34a0509ba594162ae76779d1b9d6d9c89ab9e3d03d68edb8e4752bd2e2dcea52edcfaf12270cb7f9d004262b7594910720ff0a4548918d500d55dd4 SSDeep 98304:efDJPXtlTzWq1FVGbaRsB1Rf78oI9M+PP:ebRX//NwdA TLSH C116AF0BBC900999C5AAAB36857341627E707C489B3663D76F80B7BD3F72BC65934B04

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE01ab970e35894f7aae5974d16799d75dGo Loader (Factory-v3)

Structure

P7B[Authenticode]_ca4d06d9.p7b

EXE[GoLoader payload 1].exe

Structure

BINOverlay_6c7d7cf4.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3EE000 size 8048 bytes
GoLoader	`GoLoader payload 1: 1493323 bytes, sha256 a5830a815c7fe9ed2094bd9aa9d7c3bf773f2a6aed5ad07dcb893344c2ba14d2, Go/affine-five-pass -> literal-prefix:c7e9ebd90e130827414732 -> initializer:0x14613e -> subtract-indexed:bias=15;index=31 -> Reverse -> subtract-indexed:bias=31;index=13 -> SwapAdjacent -> subtract-indexed:bias=128;index=7`