47eb130f82a0ed7ce09a984f92912e5b

PE Executable

MD5: 47eb130f82a0ed7ce09a984f92912e5b

Size: 3.81 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

3.81 MB · 3,807,264 B

Hashes

MD5 47eb130f82a0ed7ce09a984f92912e5b Sha1 724ff952801621aeb96eefc38ec5e03e3214e646 Sha256 25463b3ae1b55115cb4da56fffa9f90857938523533f592d78ef5ebcd02560c3 Sha384 3ceff05c78ce2de424bf05875c53eb81a00b31217d70d0765dbd846fd7a21670371cbe2fd980d904c9f38d2517ce94eb Sha512 d0cc2c11316bc350498aee12c829869b813138d5d2318b721da524f3fc1d10aab62f79901595b4625eaf703a34f7ebaf61af4e9a97cc5fa6e7ce08b917c63fbf SSDeep 49152:hCYflfdQoZOSEA8BYInO2tCPOdcY/rubv0Xv9TLtzGQBfhtohCh1:hd6HuIO5Odl/rubv0Xv9TLtztBpuch1 TLSH 5B069D07EC9148B6D4A9633288F786827B7DBC461B7263D72E50B67A2E73BD06C35350

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

2 malicious · 4 files

EXE47eb130f82a0ed7ce09a984f92912e5bGo Loader (Factory-v3)

Structure

P7B[Authenticode]_c6957989.p7b

BIN(folder)

BIN4

BIN19

BIN31

BIN45

BIN57

BIN70

BIN81

BIN92

EXE[GoLoader payload 1].exe

Structure

BINOverlay_e967f722.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>pe:exe>bin

Shape pe:dll>pe:exe>bin

malicious 3 nodes

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3A0EA8 size 2424 bytes
GoLoader	`GoLoader payload 1: 1067628 bytes, sha256 0e2320d28cde27b3a61b1f1708fe916202405449448f24d2142146239a8e27d3, Factory-v3/five-pass-legacy -> seed:0x543b -> literal-prefix:b589b333f9df14b9345c5727 -> initializer:0xc775a -> trim-end:0`

2 malicious · 4 files

EXE47eb130f82a0ed7ce09a984f92912e5bGo Loader (Factory-v3)

Structure

P7B[Authenticode]_c6957989.p7b

BIN(folder)

EXE[GoLoader payload 1].exe

Structure

BINOverlay_e967f722.bin

No malware configuration was found at this point.

You must be signed in to view YARA rules.