Deep Malware Analysis of 954da48c67138a040c2abbe37f810df6 | md5: 954da48c67138a040c2abbe37f810df6 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	954da48c67138a040c2abbe37f810df6
Sha1	1687d52377dd67c0b50446c98257ca811f7218b4
Sha256	8d38ac29168994ccaaff56ef47f1ecb0d96a161504567cd9e68b75eeea30b366
Sha384	44c2d3328c5a54c375332d70c07fdc3bf78851ba5907b896f9cf90cbf024bfad62450fc97aa63f6b9de67727993e9ad9
Sha512	9b4d944b9364a62200d450ce2afc2dcab88cadd83e421ef48a11f0a3ad5c56871cf4716fc440f1367aa2ab83d33f8870a97a32e79427d2f2f95a57014d0da23e
SSDeep	98304:WgWIMyZTTKhQn+b8IKVcdK+JobMdXGiukiX6hqJSFXgWboklP1ZFOUji/q6myPe:WgpTK6nbXVl+JoQqk7qJqYklPvFN8
TLSH	EF76F001FE9748F2E40316310967A2AF67245D458F3ADBC7FA447B7EE9376E21832249

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)