29f0a08ecf6d5d857bc42ab0c55c3ad8

PE Executable

MD5: 29f0a08ecf6d5d857bc42ab0c55c3ad8

Size: 5.61 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

5.61 MB · 5,611,896 B

First seen

2026-10-25 16:15 · 7 hours ago

Last seen

2026-10-25 16:15 · 7 hours ago

Last analysis

2026-10-25 16:15 · 7 hours ago

Hashes

MD5 29f0a08ecf6d5d857bc42ab0c55c3ad8 Sha1 255bce3c36ae07ca09fe08865dce6f04cd460f14 Sha256 ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39 Sha384 d7cbc95689eaba2b202c6061e139cd39d2da097fa16cba3cd9ce55ea5cb5d0476a93099b7e8293b9700296abd2797649 Sha512 857f2d3e3cd6224ab791b71763f65b57efbc858eb47df541b70ec1968a34944a023db6177569e901e6e644b5ed7375af348745c78b8b64ea5b74dccf6da9c608 SSDeep 49152:jcbj32Zp9c5s0RDfiQ8p78001PxN7lqRQdh8qeCmt2PdSJJbWLeLVKFiDG4ZAWht:jpO5s0YqtItIc5 TLSH 46462807BB9455E8C096EA38C4BA4653B7607C8CC33277E72E51AB742F757D0AA39B04

2 malicious · 5 files

EXE29f0a08ecf6d5d857bc42ab0c55c3ad8Go Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_79c52ccd.bin

BINResources

BINRT_MANIFEST

BINID:0001

BINID:0

P7B[Authenticode]_aca96877.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 259218 bytes, sha256 67adddf16331b19897831a188284af208823c4dbef65358f7a5b55299baa46cd, Go/affine-five-pass -> literal-prefix:5175 -> initializer:0x254ac0 -> subtract-indexed:bias=9;index=31 -> Reverse -> subtract-indexed:bias=-35;index=13 -> SwapAdjacent -> subtract-indexed:bias=-67;index=7`
Info	Authenticode present at 0x558200 size 8056 bytes

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

GoLoader

GoLoader payload 1: 259218 bytes, sha256 67adddf16331b19897831a188284af208823c4dbef65358f7a5b55299baa46cd, Go/affine-five-pass -> literal-prefix:5175 -> initializer:0x254ac0 -> subtract-indexed:bias=9;index=31 -> Reverse -> subtract-indexed:bias=-35;index=13 -> SwapAdjacent -> subtract-indexed:bias=-67;index=7

Info

Authenticode present at 0x558200 size 8056 bytes

2 malicious · 5 files

EXE29f0a08ecf6d5d857bc42ab0c55c3ad8Go Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_79c52ccd.bin

BINResources

P7B[Authenticode]_aca96877.p7b

No malware configuration was found at this point.