Deep Malware Analysis of ac90425421f2454f4d4f89c6591daaa7 | md5: ac90425421f2454f4d4f89c6591daaa7 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ac90425421f2454f4d4f89c6591daaa7
Sha1	b48fd789117e9fd3869e772505f9be96424f43cf
Sha256	432d35552fab5f79fe7f4af9ea62b2f9e777583d8bff12dda0b1f86b60799243
Sha384	8c26dff42480053ab5db6dced15c720c9585174bd1e361c665a0ed25f421cba19b8ca1a656125a385447286b61b2f6b9
Sha512	268e875ba9496f50fec57386c8e79a62298c0ec312c1edd5070ebd5ca359b6d5905e23f4088fcacf937a3a401ab8fe51485b42749c1f1c7fb2c00767e529f328
SSDeep	49152:jx6YlUc0kFljSqUfY+nQlnqS7tzyadocbJoECAq48RNr5+L2jHXR:jd1adQAsnJoEyNr5oyXR
TLSH	0116AE07BDA164A4C4999732987A51513B3CBC9E8B3573E72E94AA313F713C18DBAF10

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x41FA20 size 2400 bytes