Malicious
Malicious

29ce1bddaf9dea2addcbf9f8fbf2a783

Share on LinkedIn
Print
PE Executable
MD5: 29ce1bddaf9dea2addcbf9f8fbf2a783
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
eed2564c5812458458350371b70b232a0da1b415127bc2146135f8421776faea
MD5
29ce1bddaf9dea2addcbf9f8fbf2a783
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/eed2564c5812458458350371b70b232a0da1b415127bc2146135f8421776faea

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,793 B
First seen
2026-10-28 02:30 · 26 minutes ago
Last seen
2026-10-28 02:30 · 26 minutes ago
Last analysis
2026-10-28 02:31 · 26 minutes ago
Hashes
MD5 29ce1bddaf9dea2addcbf9f8fbf2a783 Sha1 27001346a324d94017e393e4743d77ad4f925b0e Sha256 eed2564c5812458458350371b70b232a0da1b415127bc2146135f8421776faea Sha384 c8ab98f9062f307e1fb5b0154f38d18c9231a25d7ac838db89d125f3fba088a309b68c4fd5fa75e92634f6e1b1261941 Sha512 b2c20542ea2a54065b2d23ab7e48dd39d4111158fe5f7eba073e6c33ab4f398a57b6890174196e14bc7d300e3fcc1b5aec04bec12fff7496709f3c0bcaa4739f SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+8:yBkKr5rszpNDy+8 TLSH 76C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE29ce1bddaf9dea2addcbf9f8fbf2a783Go Loader (Factory-v3)
Structure
BINOverlay_90d15eb7.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_90d15eb7.bin (169 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙