Malicious
Malicious

829a9de4fe09562f917c2de77d9f1e79

Share on LinkedIn
Print
PE Executable
MD5: 829a9de4fe09562f917c2de77d9f1e79
Size: 12.57 MB
application/x-dosexec

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
ecda1ecc579e7b586528d1d94c33060e4aca1c0444ae0550cd488defe00320a3
MD5
829a9de4fe09562f917c2de77d9f1e79
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/ecda1ecc579e7b586528d1d94c33060e4aca1c0444ae0550cd488defe00320a3

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,570,969 B
First seen
2026-10-26 00:16 · 36 minutes ago
Last seen
2026-10-26 00:16 · 36 minutes ago
Last analysis
2026-10-26 00:16 · 36 minutes ago
Hashes
MD5 829a9de4fe09562f917c2de77d9f1e79 Sha1 7b2752517dc32f57e3b287702f0e7c3825c61dab Sha256 ecda1ecc579e7b586528d1d94c33060e4aca1c0444ae0550cd488defe00320a3 Sha384 d7ac2222d95116c4023d5a60261b8e5324971be3e205892884a36b70316c24a5a1791dd860b7bf458d6d2bb2f698798d Sha512 f10851f9f09bc73608e2fe5e1c6c2ac9516f3137841f159739a2ead15ac149b2c907b8fd32ada72610cbfe0b3230fa3b04cb240159d28bcc56cf1462e7d7b8a7 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+j:yBkKr5rszpNDy+j TLSH 12C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 1 file
EXE829a9de4fe09562f917c2de77d9f1e79Go Loader (Factory-v3)
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙