Deep Malware Analysis of 0963a9a8977eb4f2b2130bb00fe5379c | md5: 0963a9a8977eb4f2b2130bb00fe5379c | Executable | PE (Portable Executable) | PE File Layout | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0963a9a8977eb4f2b2130bb00fe5379c
Sha1	54e3374775dd80532a7cfd40fde81807a39220c4
Sha256	3c6e8ab445e9a1add14f5cc5951f4e2f1e952de9fbe1ed1b3bf22026b781f5c4
Sha384	9a8ec906c516371b4ebdb562190e52baeea96226a178292b0848924fe2724b55f9799e042e87067b8e01ffba808d28c7
Sha512	affbbea7e4a63e3158387df5c1cfe988f31f156cb9b2f15d183c74d72dc4029614d469572a6a9f38a41bfada278cb3a04cf12d30cf54cf40c6b6071ea67a352a
SSDeep	24576:S2r8jG8uDKCN3QARaBAoql8BgDxI94x9x/1PjvAGTH5ZbHhIm1MWyePaph2Cpph0:VgjG8uWCbRaBzqu+DxI9yUWyUudBgZ4m
TLSH	D786E75971C410EDCA8E837608F45DBA27B21DBB1713A6CB07A5BBA42F13BE55F30948

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12Private EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x7E9800 size 8120 bytes
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`