Deep Malware Analysis of 0bd608e47212b7d824cf538fec504e16 | md5: 0bd608e47212b7d824cf538fec504e16 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0bd608e47212b7d824cf538fec504e16
Sha1	a425b0218a08d14e02c4168ad9f103a1d8a1e0b5
Sha256	5d73848da175ffb13caebd385d6a7ebb3392d04cf0fc03e4e02caefc8a83c8f3
Sha384	4588b175f2788f1ffb5c66950fc9774b8b7bf74c9e58b63c989ed86991abbae470d919bccd34e94a0d50414670f2c93e
Sha512	18ba44aadc2390c7403ea8670e733f2e4e98a1fb7876cf7106f19e7364638f99c237b8e769728656bfa3cd94b298d6c0a075602d050aca7967e06e1f84e01361
SSDeep	49152:JKzR+G2rMQA77dovTcJgPZNrqkynl6v7Cr/cZ4gZJj2lUZ8/pJwrT3P4a1MD0wpW:JXlAlITml6z1JClvpJwH/9MD39fO
TLSH	77466C07BB954464C09AE73485EA4362B7BAFC4C873723D76E94A6B42F323D19A35F04

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x552600 size 8056 bytes