Deep Malware Analysis of 3f5f26029bbec5ad6da34876507c1943 | md5: 3f5f26029bbec5ad6da34876507c1943 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	3f5f26029bbec5ad6da34876507c1943
Sha1	9510de1f1dc94d8124067e75edfadee0d9c9801b
Sha256	bf5d23c15f1020f587b3109b32ad6c008175052bc92810a14ae10168ac0de13d
Sha384	d2f695ec165f28438cadc11a5fa8bb1589d2093edc9c22490ae0f53b9a542669bb849d758bf03260a55c2d10462a62b7
Sha512	359129c05e00f09f2f0470d127ab536ad8ae40f3e2e69357db29490aa637d594cc4d7aed527a716322e6348938fa81bc6e0eab904f88a169287d63ba5300ff27
SSDeep	49152:PwcVGll1M98TU2poJNKyG25ZNiaXabdKqYfFi:PhwOHJASMwqY
TLSH	11D55907FDA148E5C0AEA232897691567F61BC981F3123D72E90B7B82F72BE05D79710

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)