Deep Malware Analysis of 8f9c14f00c176d0110e4c7a3e73b3d48 | md5: 8f9c14f00c176d0110e4c7a3e73b3d48 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	8f9c14f00c176d0110e4c7a3e73b3d48
Sha1	0a84ca0adfa1d5ee18a5e61637ac1d270f25afba
Sha256	ef584b25d0f409d27f1841ed85960b629d9d6870e82ee9367725b10bde56433a
Sha384	3ec8572a2d4e9d1b0f1262cf2a4281c5a7e06847021cfd7b8ed5fdab6a1fdf63e42c073ebc8a2e21caf574cc8ef3fc9e
Sha512	4942ae8f1607e31ba40cd76e91ca9d38dc0819d1580e42198d39589a29048c8bd3fe5879dea6bb076ee97e3c61644a7185c10e094e377f2da4057405b29cafd6
SSDeep	49152:BpYvUfTlhVkekHG4LHecPDpRlECVV56oeWDx6EGxOG7+8uYZL2n3o5EEazhSqYvP:vlymtcPD+WfyElt4IdG
TLSH	AB473A07FB9145A8C0DAD630C5A68262B6B5BC4C8B3623D76F50F6782F727D0AA75F04

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x183A800 size 8048 bytes