Deep Malware Analysis of 3d46be69791ad3e49fcf1a708ec8417a | md5: 3d46be69791ad3e49fcf1a708ec8417a | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	3d46be69791ad3e49fcf1a708ec8417a
Sha1	55fb933f7e3aa509e19f495f2b1e17c006770d76
Sha256	0b4e63a6488eb8c648abfa376bcaa46eb1596628ced030180441b678d314a935
Sha384	4db80169bf5f8646533f2392b92a00487cba1cf60d656246b40724654121bc9cc3cefb6f0955906f1f6aa8978d837a93
Sha512	2aaf818eff11919d1cce4466478429505624da9ca04cec0cd18ad4992ea28fc990fbb4c31cd773e865221354019af92b79de067d38902d0d95df81e5533dab29
SSDeep	49152:KvrVVbrL6TfDCPMe9q2A3x9EDD6OhVgDIWymGuh+gxml48jPr/6OUrcnLSkdDutk:K/jG0DDL6ZAD76ojpkq/d
TLSH	A9767B0BAE8591A9D469E734C9766110A274FC49DB3233E37E50FAB05F623C1AE79F10

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x708600 size 8064 bytes