Malicious
Malicious

85fc1880ad3533d9dad4f202452392c8

Share on LinkedIn
Print
PE Executable
MD5: 85fc1880ad3533d9dad4f202452392c8
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
88fa38ce67908e3bd08b375d559d1558fad0628dfc27d70fa9427f3dfca65bff
MD5
85fc1880ad3533d9dad4f202452392c8
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/88fa38ce67908e3bd08b375d559d1558fad0628dfc27d70fa9427f3dfca65bff

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,859 B
First seen
2026-10-26 01:16 · 7 days ago
Last seen
2026-10-26 01:16 · 7 days ago
Last analysis
2026-10-26 01:16 · 7 days ago
Hashes
MD5 85fc1880ad3533d9dad4f202452392c8 Sha1 d4cf05705445e579eb4151a421b63e68f19c2beb Sha256 88fa38ce67908e3bd08b375d559d1558fad0628dfc27d70fa9427f3dfca65bff Sha384 5b803a9bdeb50b1955aa505bd66a8ddd811b87e99fb2347f98995524254f8bd16aecffc0a459e62a90a7ed25e4603b61 Sha512 4dc7d8355f69888e1268adf3096921d470b256af687bebf0d09b0e5592f7943249435f07a944d8e8fef0befe97d34fd2caa8e71f432e877f8b60832e87496cc3 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+G:yBkKr5rszpNDy+G TLSH 10C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE85fc1880ad3533d9dad4f202452392c8Go Loader (Factory-v3)
Structure
BINOverlay_f8669885.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_f8669885.bin (235 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙