Deep Malware Analysis of 3c5c2be6260ce57553e30f84179ca578 | md5: 3c5c2be6260ce57553e30f84179ca578 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Size

4.8 MB · 4,798,400 B

Hashes

MD5 3c5c2be6260ce57553e30f84179ca578 Sha1 156284da99ca58be968df6182122ac0bec5110bd Sha256 fa43e663995e393a5a66f63c1e9c4b700f5c1812aa91b992a4c48d9f748e12b8 Sha384 c2b658d13e666e7806ae18f2d1435fb37d8d593d25e0f8ffcf43ec141f2655f02c65189877bb70632d5fbc09d14fc6b7 Sha512 4c0486eaf8512282a644689e3e9b641545db2591e450d2d451aa4e877fe860413be8690e6137ff19de85a52abbaffa62834a63db235922e96e433348068e4777 SSDeep 49152:hF3EprqveiqCzjiQaLRp+5uxk1NMvW0Fv99LUfvVH5AFjjwwki6VRt:hIiLje0uW2vEePKDt TLSH A8265903BF6894A9C09EFE3089A65A12B725FC1C973533E72E9067381E32BD1D5B4B15

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE3c5c2be6260ce57553e30f84179ca578Go Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_79e0651d.bin

P7B[Authenticode]_5f4ac694.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 901072 bytes, sha256 9b04a030e20640640c2cd3ee2e8432731d81be520ef2e989e32e2573df31cc1f, Go/affine-five-pass -> literal-prefix: -> initializer:0x2245f0 -> subtract-indexed:bias=3;index=31 -> Reverse -> subtract-indexed:bias=-48;index=13 -> SwapAdjacent -> subtract-indexed:bias=-73;index=7`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x491800 size 8128 bytes