Malicious
Malicious

423a7ad5d76d0dbb933e735b043bc1e0

Share on LinkedIn
Print
PE Executable
MD5: 423a7ad5d76d0dbb933e735b043bc1e0
Size: 6 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.7 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0b4e389ea5d262b3e6689847d53900a3c508572c7165e7d6b0fba384fd86a1ca
MD5
423a7ad5d76d0dbb933e735b043bc1e0
Verdict
Malicious
File type
PE Executable · 5.7 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/0b4e389ea5d262b3e6689847d53900a3c508572c7165e7d6b0fba384fd86a1ca

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
6 MB · 6,002,064 B
First seen
2026-11-01 00:15 · 2 hours ago
Last seen
2026-11-01 00:15 · 2 hours ago
Last analysis
2026-11-01 00:15 · 2 hours ago
Hashes
MD5 423a7ad5d76d0dbb933e735b043bc1e0 Sha1 d9a6ab838a17865f06df20fcecf6385df024db1e Sha256 0b4e389ea5d262b3e6689847d53900a3c508572c7165e7d6b0fba384fd86a1ca Sha384 70dbc0f42e8fcb294261eb4ae9335216f5830f0a43380ad41f78dec6f64148561637ba63279d9a2324822097d6425ad3 Sha512 7dd51c968315f05307e34db70a34b35276fc31c994add4b594344ea852bd1978c54255c67937eeb8fe50c075f745819f090bb148590536c89294b29ef7d141cd SSDeep 24576:w+wtWi0UCrrTcg/HeU/AETNgHlOeXy3Vr3JqJ2cpKDTVq5aUVIX0Afvh2UwQq/vB:wPMnUUcc+lkrnqC0evhUvFB0OuQDLh TLSH 035639137F5448B8D096EB38C57B82623631BC898B3533E72E51BA386F367D1A979704
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE423a7ad5d76d0dbb933e735b043bc1e0Go Loader (Factory-v3)
Structure
P7B[Authenticode]_ff71c5c0.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x5B7600 size 8080 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙