Deep Malware Analysis of 439772d0c739621dc48166d0eff1f544 | md5: 439772d0c739621dc48166d0eff1f544 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	439772d0c739621dc48166d0eff1f544
Sha1	c153f40df6afa43c48da8dac60bbbad0f1ef7486
Sha256	e4c463a7fb03587f6f178d4402b0c752c125352a7da99e69d4e41f84214ffa42
Sha384	ea40e40ba58f8d2bb480fd1eca639e821a48ee6f914847eed4abf5e8edb161bd280229bbb9f5e536f69c99fe864521a3
Sha512	a3e204771578bb8c0f3b99765d3146da68536ddc9fe714040c8593a6b713b8ca8dd352a5fc61b0e937cf2f8a202063ec06ac4e46e5a604f280c9c8aac599c426
SSDeep	49152:4JNaHMDzcO5G95XpOx7Rwf3XbDAZZgwc4WcC20K7mGMnLSNa9qN/GMI35IwSw/eA:4T0gwMCM0nLS1N/Gd357cA
TLSH	EE367C0369A685B1D496BB35897762627A74FC484B3533E72F44FB382F327D18AB5B00

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x4D6000 size 8056 bytes