Malicious
Malicious

7c7dc91cf772955dec7a4d937a13669a

Share on LinkedIn
Print
PE Executable
MD5: 7c7dc91cf772955dec7a4d937a13669a
Size: 3.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 3.4 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
8114bc114c3fba9ac2a80c1d84ba28bf272b164b46f42b6c12a051d6dd4bb05b
MD5
7c7dc91cf772955dec7a4d937a13669a
Verdict
Malicious
File type
PE Executable · 3.4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/8114bc114c3fba9ac2a80c1d84ba28bf272b164b46f42b6c12a051d6dd4bb05b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
3.59 MB · 3,592,192 B
Hashes
MD5 7c7dc91cf772955dec7a4d937a13669a Sha1 123444459ba96a6b71b4ca818da82bb226199827 Sha256 8114bc114c3fba9ac2a80c1d84ba28bf272b164b46f42b6c12a051d6dd4bb05b Sha384 9b9f410005b2a8a42af1a9aeafe120c1b2de05b30b59237963b23d3c61a9b808e8f1752c3a0639ec506e6199a10620ec Sha512 0102cb67ecce57fd902709c72ee7746bf9f6d14d19e7d8931ff13b0e8871774c77af0de5d25e0e79cf67ea0c72af9936d460a06015555937d022fd53667230ad SSDeep 98304:TH6zfEJbZK94K/58k4292xH5o5rPIB8cx:ScMSw4yGHW5ro7 TLSH 75F533C07329DBDCFC05B4316234933F5293BE69DC489674618E31B4EC4A7ED6AA9C42
Detection
PeID
Microsoft Visual C++ v6.0 DLLUPX -> www.upx.sourceforge.netUPX 2.93 - 3.95 (LZMA) ASL sign UPX 3.02UPX v3.0UPX v3.0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser

2 malicious · 2 files
EXE7c7dc91cf772955dec7a4d937a13669aGo Loader (Factory-v3)
Structure
EXE[UPX unpacked Lzma].exeGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
UPX
UPX method: Lzma, filter: X86CallJumpBe
UPX 
UPX anomaly: PE reconstructed from saved NT headers; DOS stub retained; PE checksum cleared; overlay not restored

An error has occurred. This application may no longer respond until reloaded. Reload 🗙