Malicious
Malicious

51eeaca40b5009bd7b2123f406069454

Share on LinkedIn
Print
PE Executable
MD5: 51eeaca40b5009bd7b2123f406069454
Size: 2.22 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.1 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
85f4f49e3cd164c59e9e5ebcb0a87d952654414ac3381ee622d39e6160bc9d5b
MD5
51eeaca40b5009bd7b2123f406069454
Verdict
Malicious
File type
PE Executable · 2.1 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/85f4f49e3cd164c59e9e5ebcb0a87d952654414ac3381ee622d39e6160bc9d5b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
2.22 MB · 2,220,544 B
First seen
2026-10-28 11:00 · an hour ago
Last seen
2026-10-28 11:00 · an hour ago
Last analysis
2026-10-28 11:01 · an hour ago
Hashes
MD5 51eeaca40b5009bd7b2123f406069454 Sha1 46964313c469d51b25204373c13e87af432086ff Sha256 85f4f49e3cd164c59e9e5ebcb0a87d952654414ac3381ee622d39e6160bc9d5b Sha384 5d526c3dd87d88230581419b831de60aa1d4bb4e6ad27ee488da4a6bccb4f2e7e1f7182d9e6c2e18f3cdaf0bb38f4274 Sha512 36c642e9589c4eb609d3ebaa954ab75db8469ec5eb112590ad50890ed0ee0df70994cfaf90e5b225b0edd29f3121030cf1ade3af6b9c3d0b6261c3b82cf69e78 SSDeep 24576:xfS8+odHcuLKWJCeso9oVJbFhZ8J8dM2DrLyCoNeleS3LGlzgo24S30Vi/1/O+U:xfSdIcuBCeb2VJTZ82HLl64/o TLSH B8A54907FCE108E6D0AAA271897295927B71BC451F3123D32EA0B3782FB6BE05D79754
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXE51eeaca40b5009bd7b2123f406069454Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙