Deep Malware Analysis of 84430433d7561de3443e41d10ce3a15a | md5: 84430433d7561de3443e41d10ce3a15a | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	84430433d7561de3443e41d10ce3a15a
Sha1	d7047b1d0323f1a726b9303441f97006b9820da2
Sha256	971e3cbbef20c1c3d24df20dc98db532bb46b04ba0132c219dc5999c07bf4069
Sha384	e07096df225bd4c0b3a072c722742922ffff4d948fa53ad24d15aa95b09c1ac55ae32d5f9ba219e05f6f9c6782337aae
Sha512	938c7b9fa1c6c7f0aa906f3f46a63d9a0773081d8fdec4242f790355437fb5ab14eaa8aa48c0e4ba8ab11297782040d495a03ce227322b1edf8ae04afe6fcbfe
SSDeep	49152:BANh49FMZI6cpad2FHdmqcLKGP6YtmOxMRNSxn2xO:BALHgNwT7tx2xO
TLSH	E1069E0AB8914E69C4D5773144A36262BB2CB818173D17CB2E50BAF53F336E1ADB6F44

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3B1C50 size 2440 bytes