Sign up free
Malicious
Malicious

5d8b74619a3783762626664894e3ea04

Share on LinkedIn
Print
PE Executable
MD5: 5d8b74619a3783762626664894e3ea04
Size: 6.06 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.8 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
cb2e73ac6ae49335bf6263c8a8a99ca5abfa6a8a8cdd4d6d29e6ebd78271fa83
MD5
5d8b74619a3783762626664894e3ea04
Verdict
Malicious
File type
PE Executable · 5.8 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/cb2e73ac6ae49335bf6263c8a8a99ca5abfa6a8a8cdd4d6d29e6ebd78271fa83

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
6.06 MB · 6,062,968 B
First seen
2026-11-02 23:15 · 9 hours ago
Last seen
2026-11-02 23:15 · 9 hours ago
Last analysis
2026-11-02 23:15 · 9 hours ago
Hashes
MD5 5d8b74619a3783762626664894e3ea04 Sha1 924c363ca059ffc81b16f36137c4eff490c4316b Sha256 cb2e73ac6ae49335bf6263c8a8a99ca5abfa6a8a8cdd4d6d29e6ebd78271fa83 Sha384 2cdc5565ec8b145430625a1984d5bb5525d97179eec29571d964a10608b125e71a66f51548c6be61a4e5c07e14a01b06 Sha512 c0267a851f79d5070a7727f706d90ed0b97d5a681aac686bfbf7cb24ae570c6fe22660115c598f8e2543b690eb6a0c934c35cd101cd9a9515d9d384885d37453 SSDeep 49152:HRNQFtUyNG+Jx8Iv+gVX7453r7YErNHXLCpL7Xg+ppYpkxTG+RFc0vgcPcP7doIy:H+fG+JKr7TpofDRupdI TLSH 9B564B23BEAE149EC5AFEB70C8B790115150F8599F3533D36E51BE202EA1BD05E3AB41
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE5d8b74619a3783762626664894e3ea04Go Loader (Factory-v3)
Structure
P7B[Authenticode]_1d1b0044.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x5C6400 size 8056 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙