Malicious
Malicious

78fb06eef2722709feb14cd85ecd74e5

Share on LinkedIn
Print
PE Executable
MD5: 78fb06eef2722709feb14cd85ecd74e5
Size: 2.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.5 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
655d159778124a3e86adaa7fb139de2c107b9936f2d719b54756de98b8135deb
MD5
78fb06eef2722709feb14cd85ecd74e5
Verdict
Malicious
File type
PE Executable · 2.5 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/655d159778124a3e86adaa7fb139de2c107b9936f2d719b54756de98b8135deb

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
2.57 MB · 2,570,240 B
First seen
2026-10-27 17:00 · an hour ago
Last seen
2026-10-27 17:00 · an hour ago
Last analysis
2026-10-27 17:00 · an hour ago
Hashes
MD5 78fb06eef2722709feb14cd85ecd74e5 Sha1 1994d6b00720a36289725b5885aecbe34307d512 Sha256 655d159778124a3e86adaa7fb139de2c107b9936f2d719b54756de98b8135deb Sha384 5cdc0e8eee4572809263b38924d8a5bc3bf0897d7c57e63b876dfcbdcee259d43a2ba4fd846d2174879555ca59fa0985 Sha512 042db3d47315e7b54c78baa6f2ae06e2f7b041b07ac1adf581b3e3a1c5ae44e0c8eb1df8a734c49154ab4b7bec8bb301a2177f28d5836eb5bd3ad027e54bb22e SSDeep 24576:o6WRoWNLEymZZqXQBbOgNX66xTrCW0g4oD/PZyNelegrLTQsGK4vpvDFhy6B:ovS6Ey/XQZTX6iqW0wDb49DFk6 TLSH EFC55B07FC9149E6C0AAA231497391927B71BC451F3623DB2E60BB782FB6BE05C79750
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXE78fb06eef2722709feb14cd85ecd74e5Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙