Sign up free
Malicious
Malicious

6efe5b9d8e5e03e4ea2a43e0a49e57d6

Share on LinkedIn
Print
PE Executable
MD5: 6efe5b9d8e5e03e4ea2a43e0a49e57d6
Size: 10.38 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 9.9 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f
MD5
6efe5b9d8e5e03e4ea2a43e0a49e57d6
Verdict
Malicious
File type
PE Executable · 9.9 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
10.38 MB · 10,383,768 B
First seen
2026-11-02 23:15 · 9 hours ago
Last seen
2026-11-02 23:15 · 9 hours ago
Last analysis
2026-11-02 23:15 · 9 hours ago
Hashes
MD5 6efe5b9d8e5e03e4ea2a43e0a49e57d6 Sha1 b0fed7064900e9c3a4ec2585f3baa49a03ad2853 Sha256 ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f Sha384 a99ab26f4b49edbad52b57c7632123757178beeda62568656d806a37c3996529cbbc756ede4b8be5031c0f98fe7b3cf2 Sha512 aa1f3875e6321664dd7e2ab02b08561c794522a80ec74ad498d2ef8cb73620f95769cb385df170ca2e1dc76f5ccfeb6e47dc7e3f088a923a0278c16d18db0465 SSDeep 49152:11suvbC82UYzgu8bZgoGgq2kKy1PCeCbnEK2zyBVb2NW0FGMC9GzpRd4gO0LTzwp:1gjXKyhQVItS2A9Sy TLSH 2BA63A03BA6902E5C4959E34C97F5263AA24BC8CDB3573D32E4075742F7ABD0BAB9704
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE6efe5b9d8e5e03e4ea2a43e0a49e57d6Go Loader (Factory-v3)
Structure
P7B[Authenticode]_41af828e.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x9E5200 size 8088 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙