Deep Malware Analysis of 429000990842d334df49dec819921cdb | md5: 429000990842d334df49dec819921cdb | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

3.89 MB · 3,885,488 B

Hashes

MD5 429000990842d334df49dec819921cdb Sha1 6e0881537e54ac5eb9d074959bd7214270b59c14 Sha256 ed79c96c27657f7ea08a57b20bfeb1e0a8ca24c459dce98b8c1b74e5d9a9faae Sha384 7155fc6e2f901a5a2881ec9e956cf1c86f28a3bd86931c9742291730573d0b8067b589c0211c07ee4f85641cc65473ba Sha512 b6757ce7ee9148d704c41f41df4a4cc8e1d46e51b4f5a9a0b8602a0615a9c8419ee0e9ff9b31e06850621b57f0aeaa2dd1be5cb737aaaf562aa7719bbfa695c8 SSDeep 49152:kVaYjjbJnawSKNWGkcWu3srqykczYt+ZMEo5AqbhQ:kzu7T+y3zw+AVQ TLSH 72064A12BFE19179E4A6E235C8A74156B7F47C4C5B3A23E31E11BA342E723D09979F08

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXE429000990842d334df49dec819921cdbGo Loader (Factory-v3)

Structure

P7B[Authenticode]_0e66cd07.p7b

EXE[GoLoader payload 1].exe

Structure

BINOverlay_e99eb442.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3B2A00 size 8112 bytes
GoLoader	`GoLoader payload 1: 925210 bytes, sha256 7f2fb7e04f5f2677b243298ed1c6c8eb27b7141c2e24651995d24ff0a2ab9bb0, Go/affine-five-pass -> literal-prefix:499765a79dacaad0a6dc -> initializer:0x18ec06 -> subtract-indexed:bias=7;index=31 -> Reverse -> subtract-indexed:bias=127;index=13 -> SwapAdjacent -> subtract-indexed:bias=-109;index=7`