Malicious
Malicious

46f0af8e0e2b6c1bf2805af9a5006cf7

Share on LinkedIn
Print
PE Executable
MD5: 46f0af8e0e2b6c1bf2805af9a5006cf7
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a35407d249d4c2bfec7e54775a4be71e6a37e5d1c65743cd094cc60945984004
MD5
46f0af8e0e2b6c1bf2805af9a5006cf7
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/a35407d249d4c2bfec7e54775a4be71e6a37e5d1c65743cd094cc60945984004

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,572,160 B
First seen
2026-10-28 00:15 · 53 minutes ago
Last seen
2026-10-28 00:15 · 53 minutes ago
Last analysis
2026-10-28 00:16 · 53 minutes ago
Hashes
MD5 46f0af8e0e2b6c1bf2805af9a5006cf7 Sha1 e5a6986fdba153520ce2156963d5f224d7bb722f Sha256 a35407d249d4c2bfec7e54775a4be71e6a37e5d1c65743cd094cc60945984004 Sha384 89c437c98423bd12dc354be5b217cee9831f8f04c81929be63be6505c1ab29acf9f2c7a8f85a5dd27b5d82b6ac7db253 Sha512 adf816ed178c4bfaccf80a2e544425ab8c7d99a478972a0f242ace85835252de4628ea73eaa8101f707e109a3e38f5c83a080bd3ab73086332d903c4984350e3 SSDeep 49152:hl14yACTBV9Llh+IWJntL4WhjiPDC9bwI9LJnsUX9odwyVB7M2K+4Q/CZ0HR68FK:J4yAEBcJnlxJiG9bjQH/Kt+HDG46LEM TLSH 65C66C11FACB58F5E9035831406BB27F23315D048B28DB9BEB183B6AFC7B6A11976705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE46f0af8e0e2b6c1bf2805af9a5006cf7Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙