Deep Malware Analysis of 0fb4e282702484ab6f40db833a77bd0a | md5: 0fb4e282702484ab6f40db833a77bd0a | Executable | PE (Portable Executable) | PE File Layout | Win 32 Exe | x86 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0fb4e282702484ab6f40db833a77bd0a
Sha1	45519a716b7d80416fbc32150818aba4ea6e9e46
Sha256	e7f172b1946b06674fb57333fdbe46af311a64bda7e104d88d35bf2312f69e14
Sha384	e01f23ef99669fbbe3f7a1036e659dcf44bf4c4ef70ece2a5b719bf6ce1558c223252f9631ddde4efe27f228f1ff4ac6
Sha512	4583faffda717126829f8ca118903070a7d843c36dcef791728fc1cace7363c1a58805d3125a8a81a35b48a284ccda134d62011274f341b3178df57a871d4ce5
SSDeep	196608:JbW048ihnjBqMPxcTzfAsoiMJ19baWCQ:l29fPxcfosu7R
TLSH	DAA69C41FECB98F6E903193001A7B26F67345D014F25CBD7EB647B2AE97B6A11833249

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`