Malicious
Malicious

5118d195532a4a8de5712bba7bbc5d3f

Share on LinkedIn
Print
PE Executable
MD5: 5118d195532a4a8de5712bba7bbc5d3f
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
16916d3e6cccdde68ce0da7701cd6e431ad601858996ddf6e55eb267fa957046
MD5
5118d195532a4a8de5712bba7bbc5d3f
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/16916d3e6cccdde68ce0da7701cd6e431ad601858996ddf6e55eb267fa957046

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,944 B
First seen
2026-10-26 01:17 · yesterday
Last seen
2026-10-26 01:17 · yesterday
Last analysis
2026-10-26 01:18 · yesterday
Hashes
MD5 5118d195532a4a8de5712bba7bbc5d3f Sha1 ab25c6a5b242d23fe3121bee3e72da17a8692727 Sha256 16916d3e6cccdde68ce0da7701cd6e431ad601858996ddf6e55eb267fa957046 Sha384 6089a28e46ae0d3399636a3de896c5d6a2d2c71f0d0cf9833104fa9c8604e1a821b0dff685e2f7d13bfe7b0294b52f33 Sha512 7569162864f910a48bac8c3929ca910785063fb5af60d5a12e019efbae5409d1c65ecaf16f493a09d03abb59bf2b61a16b0955854ebfa0df711a5bc506738063 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+j:yBkKr5rszpNDy+j TLSH A4C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE5118d195532a4a8de5712bba7bbc5d3fGo Loader (Factory-v3)
Structure
BINOverlay_48670c11.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_48670c11.bin (320 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙