Malicious
Malicious

af8fbf0642c797686360b6bf51e94562

Share on LinkedIn
Print
VBScript
MD5: af8fbf0642c797686360b6bf51e94562
Size: 6.73 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

This sample is a 6.4 MB VBScript identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
507436d5132cefeea7e35e3481c5726f00a90e041a6bbb55cfcf50b51e2b3b73
MD5
af8fbf0642c797686360b6bf51e94562
Verdict
Malicious
File type
VBScript · 6.4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/507436d5132cefeea7e35e3481c5726f00a90e041a6bbb55cfcf50b51e2b3b73

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
6.73 MB · 6,726,656 B
First seen
2026-10-30 15:45 · an hour ago
Last seen
2026-10-30 15:45 · an hour ago
Last analysis
2026-10-30 15:45 · an hour ago
Hashes
MD5 af8fbf0642c797686360b6bf51e94562 Sha1 82e8c19427bda0bbb7acfea01fc8fdc43841e48a Sha256 507436d5132cefeea7e35e3481c5726f00a90e041a6bbb55cfcf50b51e2b3b73 Sha384 2e627e0d3aed8aefdcc14cfcb9bc1738a6f0cf03c441eb1645eba7299b32c9ea7e0271cd9ea19c45e27841fc054d636e Sha512 10d33e6e0c9f8fb2d68b907becf05d1cf7954e6ef937ca7c3c2dfccab67b9e6a3df3f988277ba0c1cd26b3bc04ac5ca13c64d11cf1a7b08a889f0f058e624022 SSDeep 49152:aHUB22Cuu3M4GilFPXEZ4NPREIJzrInWX1XKtsuQg+FbVjz5EvpzVVeMc+h4jkrE:Aue0UJzrInWXhnE51c+b7hw TLSH DC664A07ECA546A9C0AED635C6729253BA717C584B3027D72F50F7382F76BD0AAB9700
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
VBSaf8fbf0642c797686360b6bf51e94562Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙