Malicious
Malicious

656d3c7bd19a04b1cc3df880052f0286

Share on LinkedIn
Print
PE Executable
MD5: 656d3c7bd19a04b1cc3df880052f0286
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
aa839b6fc9904b75bd5028732bca7ba54c07c3cb470076a0db89c501d279ab69
MD5
656d3c7bd19a04b1cc3df880052f0286
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/aa839b6fc9904b75bd5028732bca7ba54c07c3cb470076a0db89c501d279ab69

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,571,136 B
First seen
2026-10-26 06:45 · an hour ago
Last seen
2026-10-26 06:45 · an hour ago
Last analysis
2026-10-26 06:45 · an hour ago
Hashes
MD5 656d3c7bd19a04b1cc3df880052f0286 Sha1 cccbeea38669c1a1e9f34ffe141e442bdcb75768 Sha256 aa839b6fc9904b75bd5028732bca7ba54c07c3cb470076a0db89c501d279ab69 Sha384 c4de4ec436978328279802f6171a377eef0eed4d02b9b7ea83eec486f81a5187445a5a06da8f8268c65ac50cf3b4a6e4 Sha512 4089b8ee174ff99e1f6a7a80638cf87671f57ee32a36de7bff4072c33995600a3c0a15cb953af5d9d73561461554444fd7ad3b8d4dd95016a3b0e18447cad51e SSDeep 98304:4YDuRbCLnr4kivY31IeLM07GPwagE4tG20CiEZV:YCgdYlIeLkPwHEHST TLSH C4C65B11FACB54F5E903583140ABB27F63315D048B28CBDBEB143F6AF87B6A1196A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE656d3c7bd19a04b1cc3df880052f0286Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙