Malicious
Malicious

b2501e9b9f7d015c30d4896101e089fe

Share on LinkedIn
Print
PE Executable
MD5: b2501e9b9f7d015c30d4896101e089fe
Size: 2.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.5 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
25928c53e885ea5b06beaf9b3e55fba0f52294eb2e9f549bd870e32a7095bf0f
MD5
b2501e9b9f7d015c30d4896101e089fe
Verdict
Malicious
File type
PE Executable · 2.5 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/25928c53e885ea5b06beaf9b3e55fba0f52294eb2e9f549bd870e32a7095bf0f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
2.59 MB · 2,590,208 B
First seen
2026-11-01 16:00 · 4 hours ago
Last seen
2026-11-01 16:00 · 4 hours ago
Last analysis
2026-11-01 16:00 · 4 hours ago
Hashes
MD5 b2501e9b9f7d015c30d4896101e089fe Sha1 d391d8fb7d17364ce18f973e8c9958e34ff3aaf9 Sha256 25928c53e885ea5b06beaf9b3e55fba0f52294eb2e9f549bd870e32a7095bf0f Sha384 5ea3edd4f94a0d9ec77be66e647bfb12de2f1a222f1956a793c6a8fda204a5bb52132c72346e1b483cd679788e8bd6a8 Sha512 88c659cec8585775f62c243dd5f2749fb157ca0aed5b4ebe00b36fff5237a0e74cc8c369539645956272550a503158f54b2f97e7ab2774d7dda1cca64585daeb SSDeep 24576:SUsY1VfIy5IOWGM5AY2tfWCMVrPTSOeNnJAZyNelegrLTQsUze4Szm7z4EuCHNUG:SUDPfIydWv72teFxPwC4L3u0pT TLSH 0DC56B07FCA249E5C0AEA231896295827B71BC451F3623DB2E50B7783FB2BE05D79714
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXEb2501e9b9f7d015c30d4896101e089feGo Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙