Go Loader (Factory-v3) malware analysis – e07c5e686877

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

7.79 MB · 7,789,456 B

First seen

2026-10-13 05:00 · 12 days ago

Last seen

2026-10-13 05:00 · 12 days ago

Last analysis

2026-10-23 19:23 · 2 days ago

Hashes

MD5 7caa3b84685b1709ecdd7bc363bbbb45 Sha1 f704d266aec87000ada46cb39ed833a381a48cb0 Sha256 e07c5e686877ffef93fd223bdf420f13e3e0d8fac952336f6f8359d55bc6e06b Sha384 97f7b9c1801ec3e7e6d748229b44c2a535503c09a2e50ee6c47df621519d713fc291774059a87700752d80dbdf0fe372 Sha512 a3af6c331fc794ca0dea4f6b5a965c9b975596dcf8aea10f5be9903751aca0ab0cd9cee07a90216b04541e3c1762d4df4cde81e08be4641529f9dc023df12e3e SSDeep 24576:WKAZGPqH6Frt29W5z9OXJSob806Dfy2YqQ7lV+Nh5/rN7O:W1GPqan2Q5aHqQrgRr8 TLSH E376E96971C410E9CA8E837644F45DBE23B23DBF5613A28A0759BBA13F13BE55F24D08

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 3 files

EXE7caa3b84685b1709ecdd7bc363bbbb45Go Loader (Factory-v3)

Structure

P7B[Authenticode]_87ca9730.p7b

EXE[GoLoader payload 1].exe

Structure

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	Authenticode present at 0x76BC00 size 8080 bytes
GoLoader	`GoLoader payload 1: 1403904 bytes, sha256 6ff2e63ccf44722e3ff5e192c5501ea21f817265b05e779891e3a890ea118057, Go/decimal-splitmix64 -> segments:8226 -> state-le:d3864b7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64`

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

Info

Authenticode present at 0x76BC00 size 8080 bytes

GoLoader

GoLoader payload 1: 1403904 bytes, sha256 6ff2e63ccf44722e3ff5e192c5501ea21f817265b05e779891e3a890ea118057, Go/decimal-splitmix64 -> segments:8226 -> state-le:d3864b7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64