Deep Malware Analysis of 34ecccf037bb12df003d0cf92566a859 | md5: 34ecccf037bb12df003d0cf92566a859 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Size

4.56 MB · 4,560,320 B

Hashes

MD5 34ecccf037bb12df003d0cf92566a859 Sha1 d7a1b59410b0bd60b63fdfa613d972344243b785 Sha256 8abdd20fea637c76086d603a63390539fda513c024528d2c920dd3d090d0762c Sha384 f0662b25cc1e8e7369fc4d57ef792d10a87a6d8be8981b02fd11a942a7ec791585c49e453b09a9981f43c3709efb3f2e Sha512 909918b41767c69f6c575208ea34b9bf5f3e84b54b575a61f0e239ab150c9a1126d8d11a48f2f836cc52487b36b78380549bbe728bed15f699cb2c9aac3167c5 SSDeep 49152:3BTkrRKOsBO2T8q4oVcQL/+knBolDhOc5ajwn9Ajz1F:311wELVnJckc9kzb TLSH B3265B13BAA540E9D45ADA34C9B75223BA61BC5CD73533EB3E0076302F257D0BAB5B09

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE34ecccf037bb12df003d0cf92566a859Go Loader (Factory-v3)

Structure

P7B[Authenticode]_64f231bc.p7b

EXE[GoLoader payload 1].exe

Structure

BINOverlay_bcf34c84.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x457600 size 8128 bytes
GoLoader	`GoLoader payload 1: 1036158 bytes, sha256 d0159a80e0164811392bd17992e135a38a532bcb0165ecf39d3d81fd5389f155, Go/affine-five-pass -> literal-prefix:2d64565f5f9984b391a1c2dfccc1 -> initializer:0x2013d8 -> subtract-indexed:bias=14;index=31 -> Reverse -> subtract-indexed:bias=-107;index=13 -> SwapAdjacent -> subtract-indexed:bias=127;index=7`