Deep Malware Analysis of 15961561d7c2766d7b1f832f5562da9f | md5: 15961561d7c2766d7b1f832f5562da9f | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

6.33 MB · 6,333,304 B

Hashes

MD5 15961561d7c2766d7b1f832f5562da9f Sha1 edb890b16b7b4f6d05de71d7e67991d907985054 Sha256 2f8d04858dcd75554f00bb5fd9011126665f90b91428222c29897275662f6619 Sha384 62fd8ecdc53f6953e2c84cf73b9e170737ed10d03f9e9895a954916294e90e60b2cab6f665a5b70ffc9def94c298840a Sha512 880027542106c7746325385a81291044b41758aa4952381b5e10f5c0a0668b2673f89202da145d18e77995f7a78112943ca2e312d03014d50f0647bd67a4a21e SSDeep 49152:aU3p2uTPeU3o1sfnIStyzHM9qBh2Y9jkEmFAgONPLxB0LJMoTPxwwonc:aSPtr9G2ojjmqzNWP+Bnc TLSH 38568C176EA594BCD0DAEA34C5A75212B625BC4C833537F73E51AF302F227D0AA79B04

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE15961561d7c2766d7b1f832f5562da9fGo Loader (Factory-v3)

Structure

P7B[Authenticode]_2b8f62fc.p7b

EXE[GoLoader payload 1].exe

Structure

BINOverlay_66031a2d.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x608400 size 8056 bytes
GoLoader	`GoLoader payload 1: 952404 bytes, sha256 0d8ffea34352bea8da5bc9ee34e17d3e644fa1f56349efe884516b5e24c7bbfe, Go/affine-five-pass -> literal-prefix:74706179 -> initializer:0x25fd2a -> subtract-indexed:bias=11;index=31 -> Reverse -> subtract-indexed:bias=-91;index=13 -> SwapAdjacent -> subtract-indexed:bias=-36;index=7`