Deep Malware Analysis of 2a6849dd74f57baf74a319bee652180f | md5: 2a6849dd74f57baf74a319bee652180f | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Size

3.98 MB · 3,978,160 B

Hashes

MD5 2a6849dd74f57baf74a319bee652180f Sha1 ccb4038d2a6413d588c2075a40044dcdf25283b7 Sha256 a5f097f9701d8e7e4d9c88631c119ea4aed931e4344288c8de4f4db2564debc9 Sha384 191cf2c684328b000ed6849ddc87810c40c4654320a122dc0b97c0d8dc575c0e5cdc69d64d39e01c497503b2f9780dbe Sha512 1f0a86e4c906d448ec8de31648e01dd80d64983703045993796f6db582b701350cb75d1f69d3d9a0a4f9776d08d149ca3cbf29b459163287b76930de4b25d2d5 SSDeep 98304:Bk1nfIIVG+cKHoio6Xncd4sq6VnkfA+GTPAGWFdK4pSM3UnOhiTqT1GPGw06ZcTK:Bhwe1 TLSH B0067C077EE441E9D0AA9E38C4AB5113B6A07C48873123E72F40F9342EB73D56A7AF55

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE2a6849dd74f57baf74a319bee652180fGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_2d01d226.bin

P7B[Authenticode]_0aefab2c.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 901474 bytes, sha256 db8bc15f68e816b305be20b139002be95869859582cb92004634401298b6290d, Go/affine-five-pass -> literal-prefix:235a -> initializer:0x1b430c -> subtract-indexed:bias=3;index=31 -> Reverse -> subtract-indexed:bias=-32;index=13 -> SwapAdjacent -> subtract-indexed:bias=98;index=7`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3C9400 size 8112 bytes