Malicious
Malicious

3368d3569adc2fad864d446ac51079d2

Share on LinkedIn
Print
PE Executable
MD5: 3368d3569adc2fad864d446ac51079d2
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
8211cd8cc3b4ec950d4b85330b0e3cbe9566c7098cf4a8e36faf127924720831
MD5
3368d3569adc2fad864d446ac51079d2
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/8211cd8cc3b4ec950d4b85330b0e3cbe9566c7098cf4a8e36faf127924720831

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,907 B
First seen
2026-10-28 03:30 · 16 minutes ago
Last seen
2026-10-28 03:30 · 16 minutes ago
Last analysis
2026-10-28 03:31 · 16 minutes ago
Hashes
MD5 3368d3569adc2fad864d446ac51079d2 Sha1 d5082fd4f682310fa96bf9e19d803b12f36c37eb Sha256 8211cd8cc3b4ec950d4b85330b0e3cbe9566c7098cf4a8e36faf127924720831 Sha384 7bc97d86b25e16c761761daf745de2f851615686a1f5491d8af959a535bada244346501576b11678a2f22a900019cd49 Sha512 ecf8a353150cf977219ce5230e85b6a2757e0696694b083f4d39a10cdc6e226019a6dfbde729446c1d664067e1c69414e7a3fd43f623b64644ee9bdba24a1db8 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+5:yBkKr5rszpNDy+5 TLSH 0AC65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 2 files
EXE3368d3569adc2fad864d446ac51079d2Go Loader (Factory-v3)
Structure
BINOverlay_de68d309.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_de68d309.bin (283 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙