Malicious
Malicious

4a0b50fa97c1c1ecbe24bb208c13e8c7

Share on LinkedIn
Print
PE Executable
MD5: 4a0b50fa97c1c1ecbe24bb208c13e8c7
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
16eed5489c331ee704eef2bdd3e9f24059c0dded91b5c52fccda98017917dce9
MD5
4a0b50fa97c1c1ecbe24bb208c13e8c7
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/16eed5489c331ee704eef2bdd3e9f24059c0dded91b5c52fccda98017917dce9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,842 B
First seen
2026-10-26 02:16 · 5 days ago
Last seen
2026-10-26 02:16 · 5 days ago
Last analysis
2026-10-26 02:18 · 5 days ago
Hashes
MD5 4a0b50fa97c1c1ecbe24bb208c13e8c7 Sha1 d4f5d8772cc2317e4d906ce2ef4c8ef8479aede2 Sha256 16eed5489c331ee704eef2bdd3e9f24059c0dded91b5c52fccda98017917dce9 Sha384 f84ba61b6705448be7e12ac7681f76c30f536739db85762c6ea6ea408660a86e1f9e7f4b57509c6f98ada0c3fd01bc96 Sha512 e66dbc4a8efc65ecf0ff1368ce0e6a8d99a8feb2889e76dc378659ec33c3735539c5b90e441a2735677a753837bfb71b08ec691a646819c3ec9f9543cedb8c0a SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+L:yBkKr5rszpNDy+L TLSH ABC65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE4a0b50fa97c1c1ecbe24bb208c13e8c7Go Loader (Factory-v3)
Structure
BINOverlay_ccb216c2.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_ccb216c2.bin (218 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙