Deep Malware Analysis of 021977e69cd3a58fe36f81f28177690d | md5: 021977e69cd3a58fe36f81f28177690d | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	021977e69cd3a58fe36f81f28177690d
Sha1	2cf7949d5ffa6e0e1e9728ef62c88995d2ac54bd
Sha256	b748b826bacbb7f87d06749901f0d78239e9134387c66648af328278b8654305
Sha384	5ec359d64418d4722d470c44f9f4fbc3ca97a8435d3ca39209969f8dbefbd5e58f1a52c369607a7f9c6ca7f8c3caeaf8
Sha512	961bde59b83402443d6e604ec076b95cee67d8585fe807c50664491bf3ee539016758dc351fc52c59f28f213237d8a4dc20b0fdde8ca3cc8e601fd8f627a50e9
SSDeep	98304:cLpqLde6CzU4cEbEHrjYL3rfXaVGphzjoFFxo:cLkde6Cw4cEbEoL7fXaVGphzjoO
TLSH	BB067D07BC9188A9C0E9733095B25292B73DBC145B7A27E31D70AA753F366D19DB3B80

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3A3EB8 size 2408 bytes