Malicious
Malicious

20e2ce809ce5c3938ea58fe092d835b8

Share on LinkedIn
Print
PE Executable
MD5: 20e2ce809ce5c3938ea58fe092d835b8
Size: 2.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.5 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
09183c07bf99667be170cd9759d7ea7fd14ac9b132336633e7ff51da02d28535
MD5
20e2ce809ce5c3938ea58fe092d835b8
Verdict
Malicious
File type
PE Executable · 2.5 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/09183c07bf99667be170cd9759d7ea7fd14ac9b132336633e7ff51da02d28535

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
2.57 MB · 2,569,216 B
First seen
2026-10-26 19:00 · 2 hours ago
Last seen
2026-10-26 19:00 · 2 hours ago
Last analysis
2026-10-26 19:00 · 2 hours ago
Hashes
MD5 20e2ce809ce5c3938ea58fe092d835b8 Sha1 97a0ec4c7466744b05200649a20a3dc3bb167e11 Sha256 09183c07bf99667be170cd9759d7ea7fd14ac9b132336633e7ff51da02d28535 Sha384 7eccee0181ba44611d9fdf4c4c950f050b0e0bfedd15f1b35853e2abfba9c78ff16837310d6f7287f16b8ae47e7fcba4 Sha512 e9d9df53951f5900303d0e91d9baca55551ba813699f08106cd0dfc803b32826b7ca06b696b940c652afef5eb2cfa254cda05ebe2c57715dffb25940b0853be9 SSDeep 49152:QEV782N4hTtiM6vJ0Z/kp4eJudH97oZl:Qc8A0cDJut90P TLSH 06C56B07FC9109E6C4AAA231497395927B71BC451F3623DB2E60B7782FB2BE45CB9710
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXE20e2ce809ce5c3938ea58fe092d835b8Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙