Deep Malware Analysis of a0c412cb016d99675c5728fc38175fbd | md5: a0c412cb016d99675c5728fc38175fbd | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	a0c412cb016d99675c5728fc38175fbd
Sha1	b53de0a50faa468e15d209e9e50295bf2e38116b
Sha256	7080e9b6d894a86f58566982675d973fb24011de728cae4ac5902b0602bf52ab
Sha384	f9bd3dd5c7deb1c56dd8a0417fafd841cf78049a81eb2972674e45fee40efa58af91629e5a2ac15c83af876571b608d9
Sha512	19a5e3744276ca4131974ff8505d4a6ded2ebb1801ad55a2ee401d4feaa21813cd6ea34057ace0fcddb07e56bc0451d3194f00de548513b42f9122dda6513fb3
SSDeep	49152:QG14nQh1zdyxXzT9ZPwEfokp+HYIZK3JgwDRmhNEwzGnlCAM+9iP4PP4dIy/kc07:QoJ0huODY8
TLSH	7396E95971C410E9CA8E837604F45DBE23B23DBF5613A68A0759BBE02F13BE65F24D48

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12Private EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x89B400 size 8104 bytes