Deep Malware Analysis of 34d5e9d2af542a10a234bfb0f0cdb56c | md5: 34d5e9d2af542a10a234bfb0f0cdb56c | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	34d5e9d2af542a10a234bfb0f0cdb56c
Sha1	28d976a87e6f2a8be68b02f56db69cfef2a9ea73
Sha256	df0953028f7e51bdb5f8fd056e12c9319c33829a71dee614a04bc8fcd85beeb1
Sha384	7db45c1578b83208bf4ec1e9131bb167a7ab9ef574ef247cda0d444870c813630f94e8f55861bf373976ef05479c3744
Sha512	a42fea94d8e0d661a7911a02bc58464a4d354b050fb2f5362b5e872861a4e94d678f29e9fc68b513f16612e7d209d39491bacc757077340e26041cbb8d13059e
SSDeep	49152:T9OU7PwV98/gMXpgLIySoNXyKlLFQcyjCmJKs/Sxh:T9FhVXpBySoNidcwKGSxh
TLSH	24068B467CD14869C4ED673188BAA150373EFC089B3A67D72E20BA782F366D59D37B04

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLZProtect v1.4.6 -> * Sign by phpbb3

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x37E780 size 2432 bytes