Deep Malware Analysis of 8d0b678ddeaaf4fd6c2b2a8a919d91b5 | md5: 8d0b678ddeaaf4fd6c2b2a8a919d91b5 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	8d0b678ddeaaf4fd6c2b2a8a919d91b5
Sha1	5ba2be1525d4cbc5f346419e70ecae74107bdef4
Sha256	30cfc02c5fd44b50a2741aa658f518727cddcd909942cb7c8d93c0c723571144
Sha384	6d4afadfd56300b845278dd110b395fcc4fe7904c51f6c7b9501dfedbb6ce61dd47a3f58a654e4d078cd02beac552354
Sha512	e5821e3bb29cf98a09476993ecc4f33066b8cffe17b56bbd52da42fb9a923eb665b7f00369b1a8ae1d84b023e80dbe6232b6fc48562fc15535e137ce1163b5b9
SSDeep	49152:LJ5g2Vx74q+Cesxpb6TE6x+91nv71TFNsUl8utfHEN15RcS736zZJ894QjL5ECC8:14UL9v71TaOvOMZQELXADSnQBLwde
TLSH	84963B07BB914598C0EAE634C5A643627AB5BC0C8B3623D76F50F6782F727D0AA75F10

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x85CC00 size 8048 bytes