Malicious
Malicious

15d0d9b880a44f0512ee7b4954ad8a10

Share on LinkedIn
Print
PE Executable
MD5: 15d0d9b880a44f0512ee7b4954ad8a10
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
17a29bd3e29162db7116a19f8998f8da888849f8352a9d701bcb0b8d21f8f92a
MD5
15d0d9b880a44f0512ee7b4954ad8a10
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/17a29bd3e29162db7116a19f8998f8da888849f8352a9d701bcb0b8d21f8f92a

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,989 B
First seen
2026-10-28 04:30 · 2 hours ago
Last seen
2026-10-28 04:30 · 2 hours ago
Last analysis
2026-10-28 04:31 · 2 hours ago
Hashes
MD5 15d0d9b880a44f0512ee7b4954ad8a10 Sha1 bfef9e44b1408592503180fa49a1b2811159a8e4 Sha256 17a29bd3e29162db7116a19f8998f8da888849f8352a9d701bcb0b8d21f8f92a Sha384 f9c2c2cb838b74035a2b8a8f8a2d046968c4fea1bcdeaefc73323db25c0e9541d13df0cc0716a70322813f53f5ea59ef Sha512 317aea831bdf74ab0673e6be950649e81f31eb54e1743c13c6178d4446bfa98e2ce1bb103d20ffecc416a89286afe3bd55ed968b233e8998c4f42b1b428b03f5 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+T:yBkKr5rszpNDy+T TLSH 15C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE15d0d9b880a44f0512ee7b4954ad8a10Go Loader (Factory-v3)
Structure
BINOverlay_97f5e3bf.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_97f5e3bf.bin (365 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙