Malicious
Malicious

671ca084d7da69bd253304ab829a9a01

Share on LinkedIn
Print
PE Executable
MD5: 671ca084d7da69bd253304ab829a9a01
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0841b4670b41bcbe18f8f9ddab82452e5d8b520a28450588188683c088f9dc84
MD5
671ca084d7da69bd253304ab829a9a01
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/0841b4670b41bcbe18f8f9ddab82452e5d8b520a28450588188683c088f9dc84

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,798 B
First seen
2026-10-28 04:45 · 2 hours ago
Last seen
2026-10-28 04:45 · 2 hours ago
Last analysis
2026-10-28 04:45 · 2 hours ago
Hashes
MD5 671ca084d7da69bd253304ab829a9a01 Sha1 734fe5752586ba8a7995faacedee5a53e6fd3b37 Sha256 0841b4670b41bcbe18f8f9ddab82452e5d8b520a28450588188683c088f9dc84 Sha384 387cf3e7dbf844568bbaa7a837cb1bfdaac67bbb07aee82f405562e7545e237617babb78c6685b9fcf616fb9d4e17931 Sha512 415f2b25973cb5735c9427b92c2eb2020947bb5b363695eb4ce6dc88df3abf0e91282ea760e0988c7f6710660f34e49949f583718d85f58490e90aedda2153a2 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+1:yBkKr5rszpNDy+1 TLSH C8C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE671ca084d7da69bd253304ab829a9a01Go Loader (Factory-v3)
Structure
BINOverlay_891aec85.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_891aec85.bin (174 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙