Malicious
PE Executable
MD5: 544bf08e356a4e80ab79db1450a25b3a
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- baa1ddb544f1930fea6313cf4a0cde0efeba35a71986aff9a1e70adb6c263d20
- MD5
- 544bf08e356a4e80ab79db1450a25b3a
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Go Loader (Factory-v3)
- Category
- Stealer Loader
Cite this report: https://app.malva.re/sha256/baa1ddb544f1930fea6313cf4a0cde0efeba35a71986aff9a1e70adb6c263d20
Related Go Loader (Factory-v3) samples
- 42da774d270062038a702a80c1cbf95ccb296c7e0f6ecea303fb1f138c1f0dee 2026-10-30
- 36d1df281dd56854a0997f3da0627a8cffd4b3f8ae2449db4d2b7d0caaf16ca9 2026-10-29
- c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024 2026-10-29
- 0c5b257b8072cdcfa9fb6fff648f5fd5c656d98196d4aeae7d3a9c637e783b58 2026-10-29
- 4238ad79148a3af8926ac7d6fc41da3effb7895a93fe33307b5b55d4ec3b3cba 2026-10-29
- 067ff5c5937956ff11faf4f507e53c7347486b238e5ba29af40cfa24cf7a67a6 2026-10-29
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
12.57 MB · 12,570,877 B
First seen
2026-10-29 00:45 · yesterday
Last seen
2026-10-29 00:45 · yesterday
Last analysis
2026-10-29 00:45 · yesterday
Hashes
MD5
544bf08e356a4e80ab79db1450a25b3a
Sha1
07cc4aeab12a3b9289d572d8a4c6ef3f684c46bb
Sha256
baa1ddb544f1930fea6313cf4a0cde0efeba35a71986aff9a1e70adb6c263d20
Sha384
f0a009393d8dbfa1ee5a1387f91bafbe562e79389a39be0960db54c9410135ed9abb4888243c2da975b925c8b757e83a
Sha512
f3403ea9046bbda11250889027dd2b31e2ffea5af3ab7196caff2d462ad58deb6c49cdbe2f1bf2f8205ff3071ac6eeaab6a7c4708ebf9095802e33befa543ed6
SSDeep
98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+s:yBkKr5rszpNDy+s
TLSH
A7C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 2 files
EXE544bf08e356a4e80ab79db1450a25b3aT1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_a1834d26.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Attribution | |
| Info | Overlay extracted: Overlay_a1834d26.bin (253 bytes) |