Deep Malware Analysis of 64bf81b9d7234b5f8930173f1b52ffa8 | md5: 64bf81b9d7234b5f8930173f1b52ffa8 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	64bf81b9d7234b5f8930173f1b52ffa8
Sha1	4ff7017e7d9cf871d19b3b6ab1e5b53f1a248326
Sha256	d247174b58d4e6762d013e82eff8f9c33100b5785238c48c1b83b724a387c1db
Sha384	c77b34a0eb20d2b0d4e02f393fc5598ddb69bd17f6b43317d1e8bc95df1699d22e7fbdbb0a4efee6e81e6b8b41d027c8
Sha512	8f3034a886bddbff63e7053918a8cec4b00c29de855ec6728778c346076ce0c37251f1788579a95f9b77097309552772202b8136ccb731c3aa1722478f95a921
SSDeep	98304:bc1iqDbN96C1H23opJa2l+m54tG20CEEDS:pq/RH+aa2Q4HAO
TLSH	21C66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)