Deep Malware Analysis of 8c88c8d5a00e487d0a28845bc61e1767 | md5: 8c88c8d5a00e487d0a28845bc61e1767 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	8c88c8d5a00e487d0a28845bc61e1767
Sha1	7239e56ddf5dde2c1afd37434f59108353826e67
Sha256	2d057dc63210cabb7ea942d80e92792e6b73b14535a7e5bdaed17127ecd90045
Sha384	0e58e2c4e7e40c6521e59537cbf2df1b3881d69702fb2a3de899b43d2c50941c808bcbcb7ad505dd0e6268fb56d9ef32
Sha512	e4a7bd8174c1ce5c492d84dea2c5af312592f2aabdff94abc146aaad43eddba9d4d2e54a8297bfe72add44573d420ff4ca9d9582ac67c85f322e1140cba6a56f
SSDeep	98304:nbT50IfX+By372zj/o8EXYs/bjAmwhKRxlnQ+9jL/17zhzc0SLpjQsR/9CiKq1yk:nbl+XXoVX9jAmln3LJdzcjqsqiwoVIfg
TLSH	EA76E001FDCB44F6E90315325567A2AF37256D054F38DBCBEA44BA6EE9B72E10C32246

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x700C00 size 9632 bytes