Deep Malware Analysis of 0cc4776235302252f9d6b28daf007366 | md5: 0cc4776235302252f9d6b28daf007366 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0cc4776235302252f9d6b28daf007366
Sha1	4a6d525e072d67852eca9917787f9bda09a0cf2c
Sha256	ff6eb0ad45af6d471efe5724eca47f59569aabf25665777916d14bb32157f569
Sha384	a4a9dcac134f71f0f01c0c3ece2a8698d44f10b28c50432c5fccb4f5a597e52dc42a72a198f75b240b83d52ce693d026
Sha512	c274973fad2e8cae2390f751bccf76ebc1c3736d2c4c22006823d528c374bf8b1debf30a79ae2cff23a90e38d39cadf5de7f16c4625ba9f9fe5aac1adeea5ed2
SSDeep	49152:PIp3lz6ouTgnSXlsieoF6HHm18CSko6RFJttuNuYjieW9/xhGgkAp4V8yghz9DrZ:PFY/D8
TLSH	3576C95971C410EDCA8EC37608F45DBE23B21DBB1623A68A0795FBE12F12BD65F24D48

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x6E8E00 size 8128 bytes