Sign up free
Malicious
Malicious

2dda4d33d5f04cfa5363e7f5c83796e0

Share on LinkedIn
Print
PE Executable
MD5: 2dda4d33d5f04cfa5363e7f5c83796e0
Size: 12.19 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 11.6 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
33b9b3be59ca61a107660c8856e05b9eb1126cd8ed10baef9fe64c11eb0b4180
MD5
2dda4d33d5f04cfa5363e7f5c83796e0
Verdict
Malicious
File type
PE Executable · 11.6 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/33b9b3be59ca61a107660c8856e05b9eb1126cd8ed10baef9fe64c11eb0b4180

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.19 MB · 12,188,160 B
First seen
2026-11-03 14:45 · an hour ago
Last seen
2026-11-03 14:45 · an hour ago
Last analysis
2026-11-03 14:45 · an hour ago
Hashes
MD5 2dda4d33d5f04cfa5363e7f5c83796e0 Sha1 b43bdcdf4a8ff51c6e3a04073377ffb8dd32ff9c Sha256 33b9b3be59ca61a107660c8856e05b9eb1126cd8ed10baef9fe64c11eb0b4180 Sha384 cb51bfce5538abe35b6a3c82bbd673452523edfb4ac90c52d1beb572573bcabaf9a775891c9f9679184c9f1f1f516da9 Sha512 5c2bf4b34b9add1237e80888f3e57b83cbcbe9be5b7f5535fbc5f1df49f46938b12ed78289d8407ebfd55ccbbb931d7a598f6e4ea3c11a38b4ce0d849f961364 SSDeep 98304:kUcG1mh2Z1QsFQhcSb9vHcntZ8Me1JxAJGjllMIAYAFsinn9JEEK:komYZ1zgutZ8MeXvjEkAFsm5K TLSH 31C65B47ECA541E9C1AE9135C6269123BEB13C885F3067D36B50F7282F76BD0AEB9710
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE2dda4d33d5f04cfa5363e7f5c83796e0Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙