Malicious
Malicious

abc580ad3860919a5b2cdd8d9f48cbaa

Share on LinkedIn
Print
PE Executable
MD5: abc580ad3860919a5b2cdd8d9f48cbaa
Size: 2.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.4 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f59012e49f2e8fd657a11cf2008fe74ca289d189552e29cdc3d1078956ad0d31
MD5
abc580ad3860919a5b2cdd8d9f48cbaa
Verdict
Malicious
File type
PE Executable · 2.4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/f59012e49f2e8fd657a11cf2008fe74ca289d189552e29cdc3d1078956ad0d31

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
2.57 MB · 2,567,168 B
First seen
2026-10-26 17:00 · 52 minutes ago
Last seen
2026-10-26 17:00 · 52 minutes ago
Last analysis
2026-10-26 17:00 · 52 minutes ago
Hashes
MD5 abc580ad3860919a5b2cdd8d9f48cbaa Sha1 5bcee2e27ed48fed733580f4c6a7b8fde4bd6976 Sha256 f59012e49f2e8fd657a11cf2008fe74ca289d189552e29cdc3d1078956ad0d31 Sha384 eae8adc6d15a5fb903e40fedbf9574f8e3306050731fe7efc53737d3520f806ab8c855a4b35ff1610d285caa13aa743e Sha512 eb77198e9f1130c88af616290f21277a09cb2d79e4aa5e68f131a0fd8a45ec96ed468c1a2611aecc2dfeebc016a93e055433321bea1d7255eeffaa9dfe4a38fa SSDeep 24576:H3YKd0yvXZCtWp99te+EtoGwYVc1GFml/HWNCRyNelegrLTQsRB4vAkK9VyIV8oa:H316yvX9pDvwoPecQsW84zVIV8oxE TLSH 91C56B07FC9109E6C0AAA231496395927F31BC491F3623C72EA0B7782FB2BE45D75B54
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXEabc580ad3860919a5b2cdd8d9f48cbaaGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙