Malicious
PE Executable
MD5: 97ad9f9455e0ce5eaa26f53aba9991d3
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 873aacdd29d787b3bff0b4637b26b2155044c58bb86fab3dac7351e596692661
- MD5
- 97ad9f9455e0ce5eaa26f53aba9991d3
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Go Loader (Factory-v3)
- Category
- Stealer Loader
Cite this report: https://app.malva.re/sha256/873aacdd29d787b3bff0b4637b26b2155044c58bb86fab3dac7351e596692661
Related Go Loader (Factory-v3) samples
- c31031efad2d7fe4d436a5a8b962f5dd1b64f3026e96b5ebe2dd184987a8d83f 2026-10-29
- 12731350ac7d6cbe888e61b9754977bb85f2bbceb048170522237e94439cf17f 2026-10-29
- 2f393bd2c6801381eb8a2c78996ceef0355d4bc51d666769ab56ed3ffdef512b 2026-10-29
- 05cfac8008d88e131e7e81c7b58e783699080586792f54c9b0dfcda5738ed004 2026-10-29
- 947768adbdf6fd085afb7e191cdd9c1c85df467b61adb9a57ffb078fd3043a26 2026-10-29
- d6c1fad577dd6c2464c13f83a1a7955bfaa6a6f6405a41fe963dd7505f04fbd3 2026-10-29
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
12.57 MB · 12,570,963 B
Hashes
MD5
97ad9f9455e0ce5eaa26f53aba9991d3
Sha1
8bcf85fa3c91c670da715ef6bbbc58e90a614e47
Sha256
873aacdd29d787b3bff0b4637b26b2155044c58bb86fab3dac7351e596692661
Sha384
93247ecf0c5c790b93538c3393e3ed80dbcf5e6d30bb32367f67424073279c9e213a2b40d9ee139156167fcb90d5b7a8
Sha512
87371715acad34010b7cb39d057faf72bb19f6d4eeacbe0532b4cc183c8732ca3387f636d9d0a345c0cf0fc3dded115e3a575530349bd18c5403262461d89cc7
SSDeep
98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+V:yBkKr5rszpNDy+V
TLSH
06C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
1 malicious · 2 files
EXE97ad9f9455e0ce5eaa26f53aba9991d3T1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_d132b5f3.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Attribution | |
| Info | Overlay extracted: Overlay_d132b5f3.bin (339 bytes) |