Malicious
PE Executable
MD5: 54c86fa4c41496da1e97639d0a5db661
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 1cb2e01b531a7b5074b9c9be4bdab93e025e112d6dc1b39d49d5d8ce1dffb4f4
- MD5
- 54c86fa4c41496da1e97639d0a5db661
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Go Loader (Factory-v3)
- Category
- Stealer Loader
Cite this report: https://app.malva.re/sha256/1cb2e01b531a7b5074b9c9be4bdab93e025e112d6dc1b39d49d5d8ce1dffb4f4
Related Go Loader (Factory-v3) samples
- 1fbaa32225f246cd2d610e7f56a7286acbd5e63f224c807af7c8923fde31581f 2026-10-28
- 2163047d98d5d694d5491928c17d8459e3db36fc5422c9bbf9fe518b493d21ba 2026-10-28
- 4c3350f65c718ef01fa8acda7beeedee8c769e922e395106947c2febdef886bb 2026-10-28
- 85f4f49e3cd164c59e9e5ebcb0a87d952654414ac3381ee622d39e6160bc9d5b 2026-10-28
- 9c1b195ecc5d234296c315fb5ff6d512a43fdbb54be956111f337add02374798 2026-10-28
- 8114bc114c3fba9ac2a80c1d84ba28bf272b164b46f42b6c12a051d6dd4bb05b 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
12.57 MB · 12,570,868 B
First seen
2026-10-28 11:16 · an hour ago
Last seen
2026-10-28 11:16 · an hour ago
Last analysis
2026-10-28 11:16 · an hour ago
Hashes
MD5
54c86fa4c41496da1e97639d0a5db661
Sha1
d87008dc43de6d1cc79974a15940895448a5e21c
Sha256
1cb2e01b531a7b5074b9c9be4bdab93e025e112d6dc1b39d49d5d8ce1dffb4f4
Sha384
7b96acb443137a5077389864b8453c86ccb11337a0fc79c090e51acab0f93ce439d587776ce0c8abc31d5e86af9bacc7
Sha512
17319e6c047d5c362ffc235c4ecc23ba06a3fe9129edf998e3c900f021c1f109b3d5a9f44e5aefc7e6330ae8b6c7cb15100432f79663da60576a65c5eb7a4790
SSDeep
98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+O:yBkKr5rszpNDy+O
TLSH
B3C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
1 malicious · 2 files
EXE54c86fa4c41496da1e97639d0a5db661T1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_afd9235f.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_afd9235f.bin (244 bytes) |
| Attribution | |