Malicious
Malicious

67c293c019963db821699a4ad104f3fa

Share on LinkedIn
Print
PE Executable
MD5: 67c293c019963db821699a4ad104f3fa
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a2fb6777eeb5551a1d23f3ba8a0ef00ca62638f8742d4d227798cdf7a8bcaa12
MD5
67c293c019963db821699a4ad104f3fa
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/a2fb6777eeb5551a1d23f3ba8a0ef00ca62638f8742d4d227798cdf7a8bcaa12

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,571,136 B
First seen
2026-10-27 00:15 · 45 minutes ago
Last seen
2026-10-27 00:15 · 45 minutes ago
Last analysis
2026-10-27 00:15 · 45 minutes ago
Hashes
MD5 67c293c019963db821699a4ad104f3fa Sha1 2984e535f3d41342a0f27e3370a77df67b08088f Sha256 a2fb6777eeb5551a1d23f3ba8a0ef00ca62638f8742d4d227798cdf7a8bcaa12 Sha384 eaff743dcd727fa6d23563e3c46819f3c8371ab993cecb90392f168d99d73679580df0b56ac41389632437332f8028fb Sha512 73cd5b9a503cac6606e0dde6ed6def5984227b90d24e864abbd19fb6f5964e92a8e9222370fc60c99440ebf1f18bb6b7235e18ee5bdbf0bebeeaf58d285d7072 SSDeep 98304:KJtQfO03IbL8invwOYWb3H32jfJm1c4tG20CwEdf:w0qdvpYWb2jfwyHol TLSH E6C66B11FACB58F1E903583140ABB27F63315D048B38DBDBEB143B6AF87B6A11966705

1 malicious · 1 file
EXE67c293c019963db821699a4ad104f3faGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙