Deep Malware Analysis of 68603acaae577b6643e0a7effbb521d1 | md5: 68603acaae577b6643e0a7effbb521d1 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	68603acaae577b6643e0a7effbb521d1
Sha1	e8ca99e4a1e280ccea27e2d1d943a31ee375eee3
Sha256	cd56540cd8689a6874aeeed76841456c08d6afdaf3034598e60cf620f0ae0591
Sha384	14d3b6d82558dbbb6aebfbe5605f3de028a225d5b283eda2c87677b2690917eda083fa97d819dfbe7a11703edb2fbaa1
Sha512	e07fa8b19f33ab9d758fd7d9279ce8e9d2be5e2383b938de6bf7bba393ec636cd0754f4bafe8f35d60debb92be3535641c29a64a4f13bae1b48f1e2ccc53fcfd
SSDeep	49152:AVJ0GDXPl6yrZxvkBBlXhfTcCfVmuzQNZ6jSLLiMRVSyi/j4D17/R+fKiK9KYe5E:AYicdrwNojSHiUB9jAU0E
TLSH	CE565B43ECA555E9C0AAE23189679212BBB17C495F3123D32BA0F7382F76BD06E75740

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)