Malicious
Malicious

75d3e67d8c10065d459a014d482aae73

Share on LinkedIn
Print
PE Executable
MD5: 75d3e67d8c10065d459a014d482aae73
Size: 9.94 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 9.5 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4fe4cfa7fe9c136e6ecf3e470c8376aa6e3dfd21ee39c834a105d95f9a1fd8c6
MD5
75d3e67d8c10065d459a014d482aae73
Verdict
Malicious
File type
PE Executable · 9.5 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/4fe4cfa7fe9c136e6ecf3e470c8376aa6e3dfd21ee39c834a105d95f9a1fd8c6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
9.94 MB · 9,938,432 B
First seen
2026-10-27 09:30 · 3 days ago
Last seen
2026-10-27 09:30 · 3 days ago
Last analysis
2026-10-27 09:30 · 3 days ago
Hashes
MD5 75d3e67d8c10065d459a014d482aae73 Sha1 16517d55302ae6cbd424136d1e05050898489758 Sha256 4fe4cfa7fe9c136e6ecf3e470c8376aa6e3dfd21ee39c834a105d95f9a1fd8c6 Sha384 92888517e32f902629f81fcf2ce2e39379624bd24d17f497bd65e62d3d8765c25f022944044538dba093473789f8c5cb Sha512 34aa29d0ab32b9fd538f9e9d1ad13c8f5acd5c327df3790f7e564c182b2fdaa1bdbc7f7295a1067158c8eb2cfc22005fa359e7e405c8b6d8afe4a19724196c0f SSDeep 98304:zyvx4MA9kjMrJZec7rZObFTGnvjcEhU8+1yuQe9fQcxRmcg3BwW3VHDwbGq0AtA2:zHJQ8pq8be9RQSs9qTtA2 TLSH DCA68C42FE8B55FAE503183111ABB23F63356D068F24CBD7EB507B2AE9376915833249
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE75d3e67d8c10065d459a014d482aae73Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙