Sign up free
Malicious
Malicious

3b244a85eebdc298f538cb96d317d6c6

Share on LinkedIn
Print
PE Executable
MD5: 3b244a85eebdc298f538cb96d317d6c6
Size: 4.93 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.7 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9d66a9de6fbb503c1397c21271ddb7f054bc711e17ba2f469a0cb6a828017d44
MD5
3b244a85eebdc298f538cb96d317d6c6
Verdict
Malicious
File type
PE Executable · 4.7 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/9d66a9de6fbb503c1397c21271ddb7f054bc711e17ba2f469a0cb6a828017d44

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
4.93 MB · 4,934,024 B
First seen
2026-11-03 23:30 · 6 hours ago
Last seen
2026-11-03 23:30 · 6 hours ago
Last analysis
2026-11-03 23:30 · 6 hours ago
Hashes
MD5 3b244a85eebdc298f538cb96d317d6c6 Sha1 6d7e7dc26a2c88fde345b349f244cf139d4c810b Sha256 9d66a9de6fbb503c1397c21271ddb7f054bc711e17ba2f469a0cb6a828017d44 Sha384 71e834cc0957ba559341b97250c430c918c8b80437792864b6ecab3c1c9e74762b610aef3cf0a7bbc56fac1bf68826fe Sha512 562c2ca7c35841ba9574eb52669926a3ad7256b25c72227ce8cab78bdb46dd436c11e561f801235b479ed41f2e6bae4da7f895d09ce925b027b6a3ede38e0bab SSDeep 49152:z6mfGNv0M4cjqIHoYmiP4/OnZ5rWwPcPStqszbNI57728QSiRjfmxcWw:zo06zkFSPNuPy3gm TLSH FC367C07BDE145A9D0AAD238C4671112BBB87C4C4B3273D32F50BA782E777D09AB9B45
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE3b244a85eebdc298f538cb96d317d6c6Go Loader (Factory-v3)
Structure
P7B[Authenticode]_c5d23d37.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x4B2A00 size 8072 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙