Malicious
Malicious

061b7dadd487af29d68900670b3d6d2b

Share on LinkedIn
Print
PE Executable
MD5: 061b7dadd487af29d68900670b3d6d2b
Size: 2.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.5 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
6b1e7396de3a881485722b6c13080dc08741f8fa5d138e77a92cac769793afb4
MD5
061b7dadd487af29d68900670b3d6d2b
Verdict
Malicious
File type
PE Executable · 2.5 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/6b1e7396de3a881485722b6c13080dc08741f8fa5d138e77a92cac769793afb4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
2.59 MB · 2,590,208 B
First seen
2026-11-01 17:00 · 3 hours ago
Last seen
2026-11-01 17:00 · 3 hours ago
Last analysis
2026-11-01 17:00 · 3 hours ago
Hashes
MD5 061b7dadd487af29d68900670b3d6d2b Sha1 730e6efbe6ab3b95959e8279573871597124086f Sha256 6b1e7396de3a881485722b6c13080dc08741f8fa5d138e77a92cac769793afb4 Sha384 bbb941cbbc78b4cb533b42d7c85ebe7f0cc3f6946b7ab3bd6d969620de47233f5fc63e4ef6cfe626b618a3f3dbe89dbe Sha512 0eccb2ffa7af79fe573f48aaf997f7e52b2587072251d866fd896d740fd1abce7d3ecd9a737694c2bca00596aecd512d8c3bfcc958c85e69146fc22ca246c87b SSDeep 24576:VvNOuWmu7lqPkLKW0qzrGRycxXs3mwfurAzaia9ZyNelegrLTQsUI4SjBK782If:VvkNmugPGkqzrGIeXsMAc4t7hIf TLSH 7CC56C07FCA249E5C0AEA2318A6695927B71BC451F3623CB2E50B7783FB27E05D79710
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXE061b7dadd487af29d68900670b3d6d2bGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙