Deep Malware Analysis of b2aa1f16f6ffaa05b7bcef194a96cbaf | md5: b2aa1f16f6ffaa05b7bcef194a96cbaf | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	b2aa1f16f6ffaa05b7bcef194a96cbaf
Sha1	4606320f12c502ffe7e346d44c93d66df270f513
Sha256	1c1b5e2375790f50acef5164b1025712b288fa50a3ee6266fe76d282aec2f2d8
Sha384	c00933e9a4f94b34e29207bb856545df0e62321bb5aaf4cbac4a04ef4ecb90cba05b801743815f36f43ecce36dba40c8
Sha512	a7eb034b9f31d218a6f78a91fa991a583b94d1a4d849f5a165281c968bdf0eaaa716f5d287ebc587eb1b6970782d18433c85afc8ae6dfffb1421c7784272fccb
SSDeep	98304:YoOdFt7GRqXayc9Pr3KtdyEH21vGN2jI40:9ZRqX8PrcdfH2BE
TLSH	24864907AD9181A9D0AAE634C5B68266F6657C488B3533E72F50F7782F737C06BB8710

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x812600 size 8064 bytes