Deep Malware Analysis of 1c0ba39732f699262da38725e78d82cf | md5: 1c0ba39732f699262da38725e78d82cf | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

4.17 MB · 4,174,976 B

First seen

2026-10-13 06:30 · 12 days ago

Last seen

2026-10-13 06:30 · 12 days ago

Last analysis

2026-10-23 19:22 · 2 days ago

Hashes

MD5 1c0ba39732f699262da38725e78d82cf Sha1 4f5f5c8871b36baac9c1a778425e83f4aa382ffd Sha256 b0f970472a9e2c883c65f127963abcbbac377763fde61f2c2c9efb5405d399c7 Sha384 eccd5dd906316a006bc87590e065485a5029c21e4085bfd686e42b40601c8e5187316dbbb2f3cfa2cba8e6720051691f Sha512 ca88b7ff55f448048bc7ee1fac292f13d11bd021528fbea9ed4a126076dd78cb1814aaaacc28ad96fa02d9aaf75455b72522540c3e984ddcc4e4b5bda3276576 SSDeep 49152:WcRd80KuZfAljNw/NzK2HFrjvMKBeMvAc+8pYvsdv41:WogaG2lrzMKBePc+8Wvse TLSH 4F160622ECA226D9C0DD52B0C462550236EC7C463BAD53D73A10FE7A2EB26DC5D793C6

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 6 files

EXE1c0ba39732f699262da38725e78d82cfGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_6e18adee.bin

P7B[Authenticode]_17ce77ce.p7b

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 761856 bytes, sha256 568bd82a47d458e5c8d0af76893e08ff9b10b2c75313d38db4c7b64209fcbd56, Factory-v3/five-pass-legacy -> seed:0x9741 -> literal-prefix: -> initializer:0x128f9d -> trim-end:0`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3FAC00 size 2176 bytes