Malicious
Malicious

ab5dc74bd26155fd883b7e258262f81a

Share on LinkedIn
Print
PE Executable
MD5: ab5dc74bd26155fd883b7e258262f81a
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
dce5f11ed37d33e43c03104812c8dfa1149e89cb009e2c862a75ff8ff6b3f9a0
MD5
ab5dc74bd26155fd883b7e258262f81a
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/dce5f11ed37d33e43c03104812c8dfa1149e89cb009e2c862a75ff8ff6b3f9a0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,821 B
First seen
2026-10-28 01:30 · 14 hours ago
Last seen
2026-10-28 01:30 · 14 hours ago
Last analysis
2026-10-28 01:31 · 14 hours ago
Hashes
MD5 ab5dc74bd26155fd883b7e258262f81a Sha1 7519f0b902a4ea6556c07fffb9d13f16133f7cb0 Sha256 dce5f11ed37d33e43c03104812c8dfa1149e89cb009e2c862a75ff8ff6b3f9a0 Sha384 0c222c38b375deffbf063d761ff2ad4145ea3d3ba6e75cd086b7908e90b484cdea6ea9084cca6aa7d6e0959bd62295ad Sha512 43d99121a1e89325a9611fe9396eef3bf34cd310bbdbdd6ee5600ebb9566b0279b2b8a8fb0a2de4bbec4c4c4e21292f5f7cdaa6621974d278363e312006fc79c SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+L:yBkKr5rszpNDy+L TLSH 94C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEab5dc74bd26155fd883b7e258262f81aGo Loader (Factory-v3)
Structure
BINOverlay_61196395.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_61196395.bin (197 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙