Malicious
Malicious

210f9a28f87d605c1f1562fe811fcd3b

Share on LinkedIn
Print
PE Executable
MD5: 210f9a28f87d605c1f1562fe811fcd3b
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 3.4 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
69b084e5f70a5d400c3b319ef2f0de95e506db731afeb7739e83862dc6ba1b8f
MD5
210f9a28f87d605c1f1562fe811fcd3b
Verdict
Malicious
File type
PE Executable · 3.4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/69b084e5f70a5d400c3b319ef2f0de95e506db731afeb7739e83862dc6ba1b8f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
3.59 MB · 3,592,901 B
First seen
2026-10-26 01:31 · 2 days ago
Last seen
2026-10-26 01:31 · 2 days ago
Last analysis
2026-10-26 01:32 · 2 days ago
Hashes
MD5 210f9a28f87d605c1f1562fe811fcd3b Sha1 61eaeae4f51d17c0486eaf28bb880c593aa14b97 Sha256 69b084e5f70a5d400c3b319ef2f0de95e506db731afeb7739e83862dc6ba1b8f Sha384 530d60540d0e7defa0f0afe99cc37ac7be16a93d552797725e88358f52cb0eecda72c6a0254f9b8582c74c3c41a5ebae Sha512 347f1e437f3ab92603517fdefc5ca99e9c967cacdf8bc4e4cdbca31430db5f95b14288f6fd2871314d51bef9adbc72feb857859b9b5da5500d9d0c5685e5a4b1 SSDeep 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4Oh:iJiafuIO7rhWEES4M TLSH 85F5335BF5AF47B3F7D9A831560FC66458B09FE40A20D38AD4DBAA9F0886BD0C241375
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser

2 malicious · 3 files
EXE210f9a28f87d605c1f1562fe811fcd3bGo Loader (Factory-v3)
Structure
BINOverlay_d49424ac.bin
EXE[UPX unpacked Lzma].exeGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_d49424ac.bin (197 bytes)
UPX
UPX method: Lzma, filter: X86CallJumpBe
UPX 
UPX anomaly: PE reconstructed from saved NT headers; DOS stub retained; PE checksum cleared; overlay not restored

An error has occurred. This application may no longer respond until reloaded. Reload 🗙