Deep Malware Analysis of 7c0085fbeb389c79322b6cc5c8bdf1be | md5: 7c0085fbeb389c79322b6cc5c8bdf1be | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	7c0085fbeb389c79322b6cc5c8bdf1be
Sha1	35a5c838f4d4582a82fb1f95d4eccf0acaf135d4
Sha256	edc576329ef82cb7c13ade5eb3edbb8de56e0fd441aafee2fd0dcdf701fefb3f
Sha384	97557c1d881fa8e565bfcff674119c100ebb1b8104eaa1706e6dbee68e8522e495fc40291971b1f48c5f9289868998e7
Sha512	0c968bc283b6e1a858e30c2747ec1bb6fe30123f5f15c5256edaec8e64a579c1f9e88ec6e109d83a881a2c3f1a7bd8169c995431d3828bf59c59d00fc39a5b14
SSDeep	98304:GnabrReFoiAy8P1S2CxgQk6b6imP1ZoGQZw3IrxQ9:GnurReWdyR7OtHIO9
TLSH	17169D17BF9589AAC0A2E330CAB65052B675BC4D1B3633D32E94B6742F727C04BB5B44

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3FB600 size 8104 bytes