Malicious
Malicious

6e79b8a857addd79509fd2da89fb70f7

Share on LinkedIn
Print
PE Executable
MD5: 6e79b8a857addd79509fd2da89fb70f7
Size: 9.66 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 9.2 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5b1d275bcf76a94979f5fb2631a01819ee32d6f0a988d4b19c6ad755df41fa60
MD5
6e79b8a857addd79509fd2da89fb70f7
Verdict
Malicious
File type
PE Executable · 9.2 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/5b1d275bcf76a94979f5fb2631a01819ee32d6f0a988d4b19c6ad755df41fa60

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
9.66 MB · 9,655,152 B
First seen
2026-11-01 17:15 · 2 hours ago
Last seen
2026-11-01 17:15 · 2 hours ago
Last analysis
2026-11-01 17:15 · 2 hours ago
Hashes
MD5 6e79b8a857addd79509fd2da89fb70f7 Sha1 9ce4c257d2c32fd741887a8ebfaa613a406db779 Sha256 5b1d275bcf76a94979f5fb2631a01819ee32d6f0a988d4b19c6ad755df41fa60 Sha384 f2f75d6d8863c3487f9bd1166a54c7ee89a64c39dbd2d032188c53c7387b379e399dd7455b6d54152946797dec1766d7 Sha512 079e1ac0b2bddae9c9bed3190d228620186d0ba7ce06fa2008e60aaa03a3ef02374d7f0b48432f5b9297d7f00131bb2ab04be30d7d7f7fa34f93a125631a443d SSDeep 49152:gxwb4OBqORFi31EytPrdvyt8vN7bG7vT3vN0KjBT7CVJKI2n63MSlY:ggGdbc4VkQG TLSH 7AA63A13BE9151A9D055FA39C4AB52367A717888D73173FB2E50AA342F733D19EB8B00
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE6e79b8a857addd79509fd2da89fb70f7Go Loader (Factory-v3)
Structure
P7B[Authenticode]_5de4ed17.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x933400 size 8048 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙