Malicious
PE Executable
MD5: 3647a254a3078185d89647c71330918f
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 10e9eb61ae20ba28a7b26c42263d0d032ed5dacf3bb88f53fd5a2b9edec73e25
- MD5
- 3647a254a3078185d89647c71330918f
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Go Loader (Factory-v3)
- Category
- Stealer Loader
Cite this report: https://app.malva.re/sha256/10e9eb61ae20ba28a7b26c42263d0d032ed5dacf3bb88f53fd5a2b9edec73e25
Related Go Loader (Factory-v3) samples
- 1d55d92387ba9001caf83b16f82c18401e42da56356de74a662268bd8057b72a 2026-10-28
- e7974a95a349bce85e821d135ad249e50371b3c9a793265db4efe8d5efe07bef 2026-10-28
- 785174a5de39e9c1151b242a889b4b210d8dade5ee24860e3ba1d5d1d5c0c54c 2026-10-28
- f185e0bf67b1ad78099682bc6237eda7a6a97eb9a11a387fdc84199e5c82b49a 2026-10-28
- 86b78febd3f923f5082b104a1ffef508e46ddfec4601286ff2457c0e1cc0ff13 2026-10-28
- e01e3ac264eca73e5cb4ecd9dae7bf4a6a44f22bf6d34461a00bd4e2aed61d2a 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
12.57 MB · 12,570,895 B
First seen
2026-10-26 04:02 · 2 days ago
Last seen
2026-10-26 04:02 · 2 days ago
Last analysis
2026-10-26 04:02 · 2 days ago
Hashes
MD5
3647a254a3078185d89647c71330918f
Sha1
9a2338d69a8ab5948bd125680a0fd48546ceeacf
Sha256
10e9eb61ae20ba28a7b26c42263d0d032ed5dacf3bb88f53fd5a2b9edec73e25
Sha384
740f3a8ae21c9ccba47202417e6a0ba7314968528e7610c89705c19256df1957bd31312ef8e57b2fb02d2df6502a49cc
Sha512
87dd0f57772b7312f5b12b76bbf2ccc97e2988408d7eb06e960d5a174a5513a959a85b6f8047485a5c65b22ea38f6b6591dbafc754712c12655f8b180e206f9b
SSDeep
98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+K:yBkKr5rszpNDy+K
TLSH
7EC65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 2 files
EXE3647a254a3078185d89647c71330918fT1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_7f701c91.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Attribution | |
| Info | Overlay extracted: Overlay_7f701c91.bin (271 bytes) |