Malicious
Malicious

47eb130f82a0ed7ce09a984f92912e5b

Share on LinkedIn
Print
PE Executable
MD5: 47eb130f82a0ed7ce09a984f92912e5b
Size: 3.81 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
3.81 MB · 3,807,264 B
First seen
2026-10-24 08:45 · 10 hours ago
Last seen
2026-10-24 08:45 · 10 hours ago
Last analysis
2026-10-24 08:45 · 10 hours ago
Hashes
MD5 47eb130f82a0ed7ce09a984f92912e5b Sha1 724ff952801621aeb96eefc38ec5e03e3214e646 Sha256 25463b3ae1b55115cb4da56fffa9f90857938523533f592d78ef5ebcd02560c3 Sha384 3ceff05c78ce2de424bf05875c53eb81a00b31217d70d0765dbd846fd7a21670371cbe2fd980d904c9f38d2517ce94eb Sha512 d0cc2c11316bc350498aee12c829869b813138d5d2318b721da524f3fc1d10aab62f79901595b4625eaf703a34f7ebaf61af4e9a97cc5fa6e7ce08b917c63fbf SSDeep 49152:hCYflfdQoZOSEA8BYInO2tCPOdcY/rubv0Xv9TLtzGQBfhtohCh1:hd6HuIO5Odl/rubv0Xv9TLtztBpuch1 TLSH 5B069D07EC9148B6D4A9633288F786827B7DBC461B7263D72E50B67A2E73BD06C35350
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team
2 malicious · 4 files
EXE47eb130f82a0ed7ce09a984f92912e5bGo Loader (Factory-v3)
Structure
P7B[Authenticode]_c6957989.p7b
EXE[GoLoader payload 1].exe
Structure
BINOverlay_e967f722.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:dll~T1027~T1055>pe:exe>bin
Shape pe:dll>pe:exe>bin
malicious 3 nodes
Path pe:dll~T1027~T1055>bin
Shape pe:dll>bin
malicious 2 nodes
Name Value
Attribution
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x3A0EA8 size 2424 bytes
GoLoader
GoLoader payload 1: 1067628 bytes, sha256 0e2320d28cde27b3a61b1f1708fe916202405449448f24d2142146239a8e27d3, Factory-v3/five-pass-legacy -> seed:0x543b -> literal-prefix:b589b333f9df14b9345c5727 -> initializer:0xc775a -> trim-end:0
An error has occurred. This application may no longer respond until reloaded. Reload 🗙