Malicious
Malicious

3b70dd19631f486d7ae69cd0f22434ae

Share on LinkedIn
Print
PE Executable
MD5: 3b70dd19631f486d7ae69cd0f22434ae
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
74a140fa0454186b1415dc5d4d688ec3da0ac3f06ec768008e98c39494960789
MD5
3b70dd19631f486d7ae69cd0f22434ae
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/74a140fa0454186b1415dc5d4d688ec3da0ac3f06ec768008e98c39494960789

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,571,648 B
First seen
2026-10-27 00:15 · 45 minutes ago
Last seen
2026-10-27 00:15 · 45 minutes ago
Last analysis
2026-10-27 00:15 · 45 minutes ago
Hashes
MD5 3b70dd19631f486d7ae69cd0f22434ae Sha1 49f32f172524c3c2d1d1c83565face39a1d4664a Sha256 74a140fa0454186b1415dc5d4d688ec3da0ac3f06ec768008e98c39494960789 Sha384 39bd908fb0858b5c3f79b4172d527a094a3d7227c275bd773a15fdde35d71ccb4fd033391ab3e075b8db80b9ed4a616f Sha512 7c6b18b8652c8ee72b457dd3af346d267615c2cbe79303690a1ecdba77bb4742f1291369d6168e7395a823d162dd52c892f908f9320ae77252a380646c0217b6 SSDeep 98304:y2VSXwsFZbzmial6pZLBxO84rc3HX+LEbO/:7szql0jk8DhbO/ TLSH 91C66C11FACB54F5E9035831406BB27F23315D048B28DBDBEB183B6AF87B6A1197A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE3b70dd19631f486d7ae69cd0f22434aeGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙