Malicious
Malicious

22da02e41c431c49797f67f0312863d8

Share on LinkedIn
Print
PE Executable
MD5: 22da02e41c431c49797f67f0312863d8
Size: 6.41 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 6.1 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0fb93dbb9525004f9e5b1ee4bcd6b6638700bee576413e955c8c96292fa964ee
MD5
22da02e41c431c49797f67f0312863d8
Verdict
Malicious
File type
PE Executable · 6.1 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/0fb93dbb9525004f9e5b1ee4bcd6b6638700bee576413e955c8c96292fa964ee

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
6.41 MB · 6,414,848 B
First seen
2026-10-30 16:00 · an hour ago
Last seen
2026-10-30 16:00 · an hour ago
Last analysis
2026-10-30 16:00 · an hour ago
Hashes
MD5 22da02e41c431c49797f67f0312863d8 Sha1 9b563590b70273a4cd5671e85e93f95b895ef45a Sha256 0fb93dbb9525004f9e5b1ee4bcd6b6638700bee576413e955c8c96292fa964ee Sha384 7773d6843779b3d4e72b2534d83ecfa6a2afcb596796f96abefdf24b3231ffe2de2d1b8bce2596c84d403e95f5a6cbe8 Sha512 dd209962cfea9d898dfb7e1416c880a99ff732ff53022459f9a67a78b8d6c1992086eb915a74cb80df35149b1b73dd3cb9d6fe5d18f0b0fff3e03719717800c8 SSDeep 49152:TMnLDb9I9TPNy51tX7N5vsMm42JF/FBa7SqfYcG9tRjL5Ezo/S0VeQrwh62FD1hv:MO9TKBwT/FCp+EMxPrwljk TLSH 25564A07EC9545E8C0AAD6358A76A253BA717C484B3027D73B50F7382F76BD4ABB9700
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE22da02e41c431c49797f67f0312863d8Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙