Malicious
Malicious

3e8fd3fef6d5b3129a859df2beab1d03

Share on LinkedIn
Print
PE Executable
MD5: 3e8fd3fef6d5b3129a859df2beab1d03
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
afee8e71ad23d0305fe03bbcd3f6e94720a972bb72fe3b8cde278ddc96b370e4
MD5
3e8fd3fef6d5b3129a859df2beab1d03
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/afee8e71ad23d0305fe03bbcd3f6e94720a972bb72fe3b8cde278ddc96b370e4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,853 B
First seen
2026-10-28 01:30 · an hour ago
Last seen
2026-10-28 01:30 · an hour ago
Last analysis
2026-10-28 01:31 · an hour ago
Hashes
MD5 3e8fd3fef6d5b3129a859df2beab1d03 Sha1 a71d86564f63ea49df4d35fbabed1bafdb9afbac Sha256 afee8e71ad23d0305fe03bbcd3f6e94720a972bb72fe3b8cde278ddc96b370e4 Sha384 033eb8c1d2519ccf0a6bea8456c4d5526e6ef4267e0fa01b4ca1321808385bb65729a9c020336419aed0492592f97fe3 Sha512 49aca04743706c3d9e14883a41cd2ca83b77e06058f4cc5de37915ff29b119a59702f48b0c0d0b12a14af21fb5ccae40e5853df99e8ca0cd7368597179038a5b SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+f:yBkKr5rszpNDy+f TLSH D6C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE3e8fd3fef6d5b3129a859df2beab1d03Go Loader (Factory-v3)
Structure
BINOverlay_5f3e75fa.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_5f3e75fa.bin (229 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙