Malicious
Malicious

1f7c8bc772b0310affcbdd9ab4b7fa04

Share on LinkedIn
Print
PE Executable
MD5: 1f7c8bc772b0310affcbdd9ab4b7fa04
Size: 6.4 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 6.1 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a7279f2425746deafef5c2ff6ebe612c7cc6062601be37d83e07ecdd1bb72ba2
MD5
1f7c8bc772b0310affcbdd9ab4b7fa04
Verdict
Malicious
File type
PE Executable · 6.1 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/a7279f2425746deafef5c2ff6ebe612c7cc6062601be37d83e07ecdd1bb72ba2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
6.4 MB · 6,400,000 B
First seen
2026-10-30 16:00 · an hour ago
Last seen
2026-10-30 16:00 · an hour ago
Last analysis
2026-10-30 16:00 · an hour ago
Hashes
MD5 1f7c8bc772b0310affcbdd9ab4b7fa04 Sha1 4706d731463858dc037e5b8543a4402551927fed Sha256 a7279f2425746deafef5c2ff6ebe612c7cc6062601be37d83e07ecdd1bb72ba2 Sha384 5ba0cd8e8f2a6e22f5abea9641bef415f26ead182898d5b88b764d0f249f8e626843c8a6e220d65758698d86aff5d2af Sha512 702b69a1b6a520d7827185c12a55b91cf12683a0f88d866a1a678dedffca21da23cd7240fda19e30b2dc779f06fe2cdb2d58baabe1a4b4ce1bbeb3b2914c3f99 SSDeep 49152:b4dtV//wc344sgxEna/zV+Z2Z/0KvoIFL19XHvhCZMjT5EkH4btVeQrwh62OtyzI:AwmYaT/0/UpRE8OPrwusq TLSH 2B564A07EC9505A8C0EAD6318A669253BAB17C484B3023D73F50F7392F76BD4ABB9744
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE1f7c8bc772b0310affcbdd9ab4b7fa04Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙