Deep Malware Analysis of 420fd012909f99f3f38a16e091e008b5 | md5: 420fd012909f99f3f38a16e091e008b5 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	420fd012909f99f3f38a16e091e008b5
Sha1	409bddbe8f8348f70acf3a604b39b834a6b5b36f
Sha256	e096855e3202ad914ea6ff670e1872d813f6104f3c0b4ed878d0fb376a772c5b
Sha384	07f258dedbbfe5179dbebd0c1008a60503be7d17f545a598ff78b3f7ad6d6f8032170e67faa1a34c6ad747bd7f41d51b
Sha512	a509b6e9c6ea6f11df9b8eddde823d3a558c0ebe0895b94a5c53df0f2b5d17d5838d3f9883a34c957ffe6410d63c454df45d2c40a33703541e0e1af6c11cf9fe
SSDeep	49152:UkaoyWxn9wH6bAld59ZZ6eKCDt3Z61ihSxoC5lQidRc63qGSAn+mT4ZOMG8sWctw:UoZxgd57E/CpZfGXNSYQdd0y46eEF
TLSH	84C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)