Malicious
Malicious

2c55362cb474173f7c505057cd69dcff

Share on LinkedIn
Print
PE Executable
MD5: 2c55362cb474173f7c505057cd69dcff
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
945fb0492e3bd25e0fb1f709c97c6e76d123e1696ddee60b0ce9c6381086d36b
MD5
2c55362cb474173f7c505057cd69dcff
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/945fb0492e3bd25e0fb1f709c97c6e76d123e1696ddee60b0ce9c6381086d36b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,827 B
First seen
2026-10-28 01:30 · an hour ago
Last seen
2026-10-28 01:30 · an hour ago
Last analysis
2026-10-28 01:31 · an hour ago
Hashes
MD5 2c55362cb474173f7c505057cd69dcff Sha1 045ebb14749dd5b5f9ca252fdae7367c3fbc3af9 Sha256 945fb0492e3bd25e0fb1f709c97c6e76d123e1696ddee60b0ce9c6381086d36b Sha384 cc7f4eee24da47f81986baf330dfdf6292d1dabc3632ebb7a58517565dc426a1bedc57b85ad21fb4d5460a275f0e121b Sha512 0fd7e7228961894cca1483676eaa7439ade96a8ff1d12b7b7b802a8c618656468553661650205910603a2a01925aa4fc8a013d46fdb05b8a1d5b7dc9208184e0 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+r:yBkKr5rszpNDy+r TLSH A0C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE2c55362cb474173f7c505057cd69dcffGo Loader (Factory-v3)
Structure
BINOverlay_78a52957.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_78a52957.bin (203 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙