Malicious
Malicious

14abd9a8a859571f9d514702b903a8d7

Share on LinkedIn
Print
PE Executable
MD5: 14abd9a8a859571f9d514702b903a8d7
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
092c9e3a29e867565708acec6039b1c7837671d16f26bd535a1d7e891c55c161
MD5
14abd9a8a859571f9d514702b903a8d7
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/092c9e3a29e867565708acec6039b1c7837671d16f26bd535a1d7e891c55c161

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,903 B
First seen
2026-10-27 08:30 · an hour ago
Last seen
2026-10-27 08:30 · an hour ago
Last analysis
2026-10-27 08:31 · an hour ago
Hashes
MD5 14abd9a8a859571f9d514702b903a8d7 Sha1 c4f8cc8139a082ff49786e9ae0ef5e7df4d87a1c Sha256 092c9e3a29e867565708acec6039b1c7837671d16f26bd535a1d7e891c55c161 Sha384 cd0d2bb9dd6fe8b437ce37185e97f3815842dce1409a229a3d1e3df75d3e527a504941b25c9495fb70e82bda2e4621d9 Sha512 eaa4ac87203e9be64176e8058ef9310ad4fd57fe7262ecec0c8e09cf284cf27a97aab1463f55ff6204b306b159a3c24756533b6cac525a0d4a2f15dbba923073 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+c:yBkKr5rszpNDy+c TLSH 68C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 2 files
EXE14abd9a8a859571f9d514702b903a8d7Go Loader (Factory-v3)
Structure
BINOverlay_91e50ef3.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_91e50ef3.bin (279 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙