Deep Malware Analysis of 40f4cb86fa67a8346de5a0a8abafb872 | md5: 40f4cb86fa67a8346de5a0a8abafb872 | Executable | PE (Portable Executable) | PE File Layout | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

3.9 MB · 3,897,776 B

Hashes

MD5 40f4cb86fa67a8346de5a0a8abafb872 Sha1 ef85d659352fe24007b86f8dad688dba30b8da07 Sha256 24c6c2c865319cb27ceadd7fef97f944785341e909359815aeca9ddb3c948a45 Sha384 fff239ed1b85adf853d561770751e22aa0c53884411cff333b854b4571aed5ddd6ab5de5233c99bc929c2d5cc6ce504b Sha512 0f143bd93dfccd4dd8cd297ceec1007a222475166e87a54775c0873b6d5952c672990e22a039a1f58d1f70cfd9436cba6b46a551e8f468dc870c2b96c025ae8e SSDeep 49152:QrSl4pucJ7UYWyNMjJ9twRasXbejsaqbhB:QgEIARaaG6VB TLSH 81064A12BFE191B9D4A6E234C8AB5116B6F47C4C5B3A23D31F11B9342E723D09A79F18

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE40f4cb86fa67a8346de5a0a8abafb872Go Loader (Factory-v3)

Structure

P7B[Authenticode]_6fbbf8ba.p7b

EXE[GoLoader payload 1].exe

Structure

BINOverlay_4fc4d2f7.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3B5A00 size 8112 bytes
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 906575 bytes, sha256 413ae019b778f78bcb42ca278e33d12424e6dc6a7e611dfdf3aeda1386d54a44, Go/affine-five-pass -> literal-prefix:cfdbf1fbe0ef1925311f571d4c5985 -> initializer:0x1951f0 -> subtract-indexed:bias=4;index=31 -> Reverse -> subtract-indexed:bias=-89;index=13 -> SwapAdjacent -> subtract-indexed:bias=-89;index=7`