Malicious
Malicious

288c3199a51f0b789973d9fe8d3d4485

Share on LinkedIn
Print
PE Executable
MD5: 288c3199a51f0b789973d9fe8d3d4485
Size: 10.42 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 9.9 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1fc557f0b6455e0b25ab8faa999761b3696eec93ebba187e02b3f77699dd8719
MD5
288c3199a51f0b789973d9fe8d3d4485
Verdict
Malicious
File type
PE Executable · 9.9 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/1fc557f0b6455e0b25ab8faa999761b3696eec93ebba187e02b3f77699dd8719

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
10.42 MB · 10,421,760 B
First seen
2026-10-25 11:15 · 16 hours ago
Last seen
2026-10-25 11:15 · 16 hours ago
Last analysis
2026-10-25 11:15 · 16 hours ago
Hashes
MD5 288c3199a51f0b789973d9fe8d3d4485 Sha1 8227b493f3ccd61d7979fdbd574f733b57c7ccab Sha256 1fc557f0b6455e0b25ab8faa999761b3696eec93ebba187e02b3f77699dd8719 Sha384 17e5bd1bd40b9c9c1e5f6e4cb42d8ca6546bc9e075d4d404f9a2d2ce7365f5753808b00890b9ff68f943c979c465e7bc Sha512 bed46cb6ff121e7e72c849cdc6f3f39bc2c38e3006e3a680d28fd80ec72a45961d5e9607fd150b669dc19d13859a02085f3387532009823c923d50506136a473 SSDeep 196608:GfIEzbrxd8BsffBnsmaJTYWsqntaqCg0ft:GQEzbsBsffB4RsYtabg0V TLSH EAA6AE43FCA559E5C0AEE5358A669252BF717C484B3123E32B90F3282F76BD06EB5344
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE288c3199a51f0b789973d9fe8d3d4485Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙