Malicious
Malicious

7da82eff0fd27597fe5a9a13114dede5

Share on LinkedIn
Print
PE Executable
MD5: 7da82eff0fd27597fe5a9a13114dede5
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
55b353ea605c440446ce15ace5f68c893b435af869b4581cc34a2edc4d3b308d
MD5
7da82eff0fd27597fe5a9a13114dede5
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/55b353ea605c440446ce15ace5f68c893b435af869b4581cc34a2edc4d3b308d

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,572,672 B
First seen
2026-10-26 06:30 · 53 minutes ago
Last seen
2026-10-26 06:30 · 53 minutes ago
Last analysis
2026-10-26 06:30 · 53 minutes ago
Hashes
MD5 7da82eff0fd27597fe5a9a13114dede5 Sha1 6a8c7a90866593c9e511654b8f9cb89af119cb6b Sha256 55b353ea605c440446ce15ace5f68c893b435af869b4581cc34a2edc4d3b308d Sha384 ecc468a7881d70e3b25b01d576cfe8cf13465d2285eddf1d25d966240fe44b2de9e0b621333b01671f3cf85822f16459 Sha512 61a0b83750dc62a6d8a5d33828bb32247776a79e6f28fa05dfe67cd540cb823413ebe1fd11ff162b993bd8b30d271a3bceadc6687cc3f799c7e10645127b36c0 SSDeep 98304:+LeG61elNbCGfnf0t0E6VzcV57OO714tG20CWEY:u6ajfffE6sZHCY TLSH 15C65B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXE7da82eff0fd27597fe5a9a13114dede5Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙