Malicious
Malicious

4982cd991c8c3ab838b7cc3ce1b5831f

Share on LinkedIn
Print
PE Executable
MD5: 4982cd991c8c3ab838b7cc3ce1b5831f
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0c07cfc632bea083d64ab1c16f7aa8ecc77b9bd24c7d489c860d846bf322b596
MD5
4982cd991c8c3ab838b7cc3ce1b5831f
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/0c07cfc632bea083d64ab1c16f7aa8ecc77b9bd24c7d489c860d846bf322b596

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,995 B
First seen
2026-10-26 01:32 · an hour ago
Last seen
2026-10-26 01:32 · an hour ago
Last analysis
2026-10-26 01:33 · an hour ago
Hashes
MD5 4982cd991c8c3ab838b7cc3ce1b5831f Sha1 c790c62d85b8be795ab5677137d9f3ad818c6e20 Sha256 0c07cfc632bea083d64ab1c16f7aa8ecc77b9bd24c7d489c860d846bf322b596 Sha384 c01165803f7ef0f38822ea89a3c9a379a41aafa9baee046ce6044518297fa97a920be99266fe777791cffedb4895fafd Sha512 b118be0b5fd1750f930756d112982644d52c52d55bd4e10891b7ee6955beca546092ffee7286b2e3c74928c39b4fc22abc67e9ff6d4db35ef4f79127e1104435 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+o:yBkKr5rszpNDy+o TLSH A8C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE4982cd991c8c3ab838b7cc3ce1b5831fGo Loader (Factory-v3)
Structure
BINOverlay_79b05217.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_79b05217.bin (371 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙