Malicious
Malicious

0a89de81d3b77593d408098aba22e495

Share on LinkedIn
Print
PE Executable
MD5: 0a89de81d3b77593d408098aba22e495
Size: 12.57 MB
application/x-dosexec

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
288c5d9cfe8fb7f7ccb99f29f76552164efbcec38d6856d8674bf4d24e783a4c
MD5
0a89de81d3b77593d408098aba22e495
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/288c5d9cfe8fb7f7ccb99f29f76552164efbcec38d6856d8674bf4d24e783a4c

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,570,972 B
First seen
2026-10-26 00:16 · 37 minutes ago
Last seen
2026-10-26 00:16 · 37 minutes ago
Last analysis
2026-10-26 00:16 · 36 minutes ago
Hashes
MD5 0a89de81d3b77593d408098aba22e495 Sha1 301dbb9a3e331ac1104c080f9264aab1822409c4 Sha256 288c5d9cfe8fb7f7ccb99f29f76552164efbcec38d6856d8674bf4d24e783a4c Sha384 8a606077f15433cfdd9a8cd6a50453238eafc144747f0cc4af719e203bc670bcdda1007562cf4221ffdc8a809d89358b Sha512 0d70403fb4a90217557612b280e8ac9b4929b1faf285f5081b964e4a190ce3910f1b1a2088f06d596e8d524870af84ef354fe5a673c07242b6bc78476355a683 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+G:yBkKr5rszpNDy+G TLSH 15C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 1 file
EXE0a89de81d3b77593d408098aba22e495Go Loader (Factory-v3)
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙