Malicious
Malicious

27b787edd054d5f8d2b434e3de3f70d2

Share on LinkedIn
Print
PE Executable
MD5: 27b787edd054d5f8d2b434e3de3f70d2
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bd2613d5ee4e574ce3ab806b9173aaf8d19125a418380c095c8dd950585a38f2
MD5
27b787edd054d5f8d2b434e3de3f70d2
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/bd2613d5ee4e574ce3ab806b9173aaf8d19125a418380c095c8dd950585a38f2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,818 B
First seen
2026-10-28 02:30 · 26 minutes ago
Last seen
2026-10-28 02:30 · 26 minutes ago
Last analysis
2026-10-28 02:31 · 26 minutes ago
Hashes
MD5 27b787edd054d5f8d2b434e3de3f70d2 Sha1 30da5d7a0388a3ec1e5bc123d1dae5a8397dc32a Sha256 bd2613d5ee4e574ce3ab806b9173aaf8d19125a418380c095c8dd950585a38f2 Sha384 64fb3fa7bdf2f6dc91a7a9207a80e55fa8b888c5ff4cae5597a34ca2e53127dbc7301ac23fdc1078bd5ab83b7616aaf9 Sha512 b994979894860adf61972a04146a8f3fc643b47d6a89e86802e218e893734d1b43e1cd8b4596d9c2200fb31d664bd43d1ddaef96785bc1dfb3e0f4a32dab9d0e SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+Q:yBkKr5rszpNDy+Q TLSH 84C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE27b787edd054d5f8d2b434e3de3f70d2Go Loader (Factory-v3)
Structure
BINOverlay_236ad17d.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_236ad17d.bin (194 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙