Malicious
Malicious

7d04d1e4161ca54ffed8f84b5430a911

Share on LinkedIn
Print
PE Executable
MD5: 7d04d1e4161ca54ffed8f84b5430a911
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
32813081922306ed327806b7eac2185c61916b2e032cb04739ae82d60ad5b0a6
MD5
7d04d1e4161ca54ffed8f84b5430a911
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/32813081922306ed327806b7eac2185c61916b2e032cb04739ae82d60ad5b0a6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,949 B
First seen
2026-10-28 00:15 · 52 minutes ago
Last seen
2026-10-28 00:15 · 52 minutes ago
Last analysis
2026-10-28 00:16 · 52 minutes ago
Hashes
MD5 7d04d1e4161ca54ffed8f84b5430a911 Sha1 2399007b315553132cd4cf0522f08b2512686006 Sha256 32813081922306ed327806b7eac2185c61916b2e032cb04739ae82d60ad5b0a6 Sha384 9d481ccb947f2f4d8ce2146a6706a6e25cd4fcc21d11e7f52a71e7a9226624360f7b0ed06981d6adaccd5fa011bd12ce Sha512 583ce37736abd559553d03b9b15c0746a39f72d948b9cde1d589017c41e5c0c26b48b1261a7515e8dd361aec1b0ec0a14efd2d5c53f8ac10417eae554afbfa10 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+j:yBkKr5rszpNDy+j TLSH 21C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE7d04d1e4161ca54ffed8f84b5430a911Go Loader (Factory-v3)
Structure
BINOverlay_6603c60e.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_6603c60e.bin (325 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙