Deep Malware Analysis of 5943946e506b78c9f6d9275e47d1d8c2 | md5: 5943946e506b78c9f6d9275e47d1d8c2 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	5943946e506b78c9f6d9275e47d1d8c2
Sha1	77600d3e93a249ce7c07441f43653da6e6379656
Sha256	64d4f79fd40347a6d1683cb4d14d21bec6b433069719d3e04cb46fe0e0c09e34
Sha384	68a0d7a6f66739ddcf5fd239da7e173dbaeaa442faa6f2b4a8fb2b21ca337b510f76012ca080c0589ae947363bb7e5b2
Sha512	de9cffadcd760ca0d66c5c8b0ce2e519a48ab6d23da3b2bd1d1bc43ea9635289d52a274583008b49873737ba6671de8010f3e117c1f92a89dbe73767b6d22f4b
SSDeep	49152:/gCBSur127L05VqtKPn3iOpcFw4iXmligOVhtwfBIJmsnFZaaPefgq/mwlslcum:/deQPn3iOpcFQ4ilVrwfaJfZNPeflFou
TLSH	1B167C13BD9188BEC0AAA635C5AA9253BA317C4C4B3273D32F61AB3C2E713D15D79714

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3FC400 size 8064 bytes