Deep Malware Analysis of 031fc988fb52f3ee6b38516b64910b95 | md5: 031fc988fb52f3ee6b38516b64910b95 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	031fc988fb52f3ee6b38516b64910b95
Sha1	5ab88a5ed2ae942a1f56efbb6c8a4f1ca120a8a5
Sha256	5821fb9adca72031ad3e3f24ccb8c9c5227172ce6d879c7a476ee703a5bf8037
Sha384	d9586fcd486efc9aa6e8ab5183a88726ad8b17c499518a3d06a8c0a8c35b8746794e835ce73aa80eb2da9fed67b58f3a
Sha512	d692c2daee37628a081f9ab27d68575e13c622b20289338b8cf755eaeb7041389c5b11bd430e9d55b66ee5db9ab7a7514ac398d26e2b72aa18de5ce758226637
SSDeep	24576:pM8QpyXfMNbEzUuSUl5VAJBDDfyNIwQI3esgdQI:m1afswzbSUl5+wQEgmI
TLSH	D9C5195575C004E9D58AD33648F05AAA37B27CAA1733A3C71B94BAB42F337E55B34B08

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x29AC00 size 8144 bytes