Malicious
Malicious

2fd4bd987d09b1626a1806ab6ceacb06

Share on LinkedIn
Print
PE Executable
MD5: 2fd4bd987d09b1626a1806ab6ceacb06
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
046e7692adf124b57a4bbbcdb62bcc97601ee87ca3bf9f40cf6e0fbbb69fc45e
MD5
2fd4bd987d09b1626a1806ab6ceacb06
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/046e7692adf124b57a4bbbcdb62bcc97601ee87ca3bf9f40cf6e0fbbb69fc45e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,842 B
First seen
2026-10-27 08:30 · an hour ago
Last seen
2026-10-27 08:30 · an hour ago
Last analysis
2026-10-27 08:31 · an hour ago
Hashes
MD5 2fd4bd987d09b1626a1806ab6ceacb06 Sha1 5a293d9242429d3111f19cc97c9ad1fa37fdc3c7 Sha256 046e7692adf124b57a4bbbcdb62bcc97601ee87ca3bf9f40cf6e0fbbb69fc45e Sha384 7d17d3528e823b9509fb5ef7a2c38473ae07b42d4332a3284f67dfda9fe6dbd13e92100e9faa13edc0577c412b3e03c4 Sha512 f49881c1161aabe67f0a3ed792f6c64493a78781d385b933f14e44d4b291d53a88cdf370ac33e78bbf33f1b6818d1597d664b156854d0b91c502cc477517a952 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+V:yBkKr5rszpNDy+V TLSH 08C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE2fd4bd987d09b1626a1806ab6ceacb06Go Loader (Factory-v3)
Structure
BINOverlay_64082269.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_64082269.bin (218 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙