Malicious
Malicious

0dd8879036c621a4a53245702ce3ecea

PE Executable
MD5: 0dd8879036c621a4a53245702ce3ecea
Size: 4.13 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 3.9 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 3 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
6e66bbe59140b869589b5a13c258fddd59fac37e7987927a73abae79fb05f655
MD5
0dd8879036c621a4a53245702ce3ecea
Verdict
Malicious
File type
PE Executable · 3.9 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/6e66bbe59140b869589b5a13c258fddd59fac37e7987927a73abae79fb05f655

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
4.13 MB · 4,126,648 B
First seen
2026-10-26 07:30 · an hour ago
Last seen
2026-10-26 07:30 · an hour ago
Last analysis
2026-10-26 07:30 · an hour ago
Hashes
MD5 0dd8879036c621a4a53245702ce3ecea Sha1 1067a478da108296c18a48a52f504d2978633e97 Sha256 6e66bbe59140b869589b5a13c258fddd59fac37e7987927a73abae79fb05f655 Sha384 cc1130b46ba2b815d9022b82e8db2471b04689fe4dca10ef789975a147b174df2d13841307322450c53bf0d96b046f6d Sha512 d8c4de500b61801380f643964d57fd43dd7781ea30ebd9f2cfe111761fd93e7f478bb5c1e172ce9f0f9a53d64415014cafef4ef542fbbf0d652e73c6cde4d9d5 SSDeep 98304:KZC5sU6auku0BmRZUA0pZ1IX6upERWTNQtmrL:Kgsyu0Y+wL TLSH 17169E037E929AA9C492B734997351427274BC1C4B3563EB2F84FB382F727C19A35B58
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files
EXE0dd8879036c621a4a53245702ce3eceaGo Loader (Factory-v3)
Structure
EXE[GoLoader payload 1].exe
Structure
BINOverlay_597b3d02.bin
P7B[Authenticode]_c0c04fdd.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
GoLoader 
GoLoader payload 1: 1468814 bytes, sha256 21272cd99be169ef22dd1b60ca276d1a2a109509e687a12fb303d4d1d2da39b8, Go/affine-five-pass -> literal-prefix:f60e11122c1c323e3a5d64626296 -> initializer:0x165829 -> subtract-indexed:bias=11;index=31 -> Reverse -> subtract-indexed:bias=98;index=13 -> SwapAdjacent -> subtract-indexed:bias=31;index=7
Info
Authenticode present at 0x3ED800 size 8120 bytes

2 malicious · 4 files
EXE0dd8879036c621a4a53245702ce3eceaGo Loader (Factory-v3)
Structure
EXE[GoLoader payload 1].exe
Structure
BINOverlay_597b3d02.bin
P7B[Authenticode]_c0c04fdd.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙