Malicious
Malicious

280ab575cc419f87538a756445a0f475

Share on LinkedIn
Print
PE Executable
MD5: 280ab575cc419f87538a756445a0f475
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
56bf8233d094186e9ee503ea781c32ba580a77851a2a1fcd0ece84ad90722626
MD5
280ab575cc419f87538a756445a0f475
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/56bf8233d094186e9ee503ea781c32ba580a77851a2a1fcd0ece84ad90722626

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,936 B
First seen
2026-10-27 07:30 · an hour ago
Last seen
2026-10-27 07:30 · an hour ago
Last analysis
2026-10-27 07:31 · an hour ago
Hashes
MD5 280ab575cc419f87538a756445a0f475 Sha1 a6d13b81ca412205ca606022ee8b5e3642781b34 Sha256 56bf8233d094186e9ee503ea781c32ba580a77851a2a1fcd0ece84ad90722626 Sha384 b76613257004f843b7a38a3bfc5db955ea3a0da42915d243b7d0ff6108a0a592a912f7bdbf65d4a1abdac08c755e914a Sha512 c699656fdbd441d3ef88c73f676da1c6489092b9d71213daa89a912b4ab2f56097ad135027c05a4a3333ebc68a40513c80480cf1037161962b80b16d881759d8 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+G:yBkKr5rszpNDy+G TLSH E3C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE280ab575cc419f87538a756445a0f475Go Loader (Factory-v3)
Structure
BINOverlay_bdabf092.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_bdabf092.bin (312 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙