Deep Malware Analysis of b2da63cb9b33dd3f8d9c21ef32e6f088 | md5: b2da63cb9b33dd3f8d9c21ef32e6f088 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	b2da63cb9b33dd3f8d9c21ef32e6f088
Sha1	0878427d0f8f806d8456402d916778d77b97889c
Sha256	9b206fbfb1ffce27c8b641989f690e701437e7e91fdbfdea808dff935c2529f3
Sha384	71f51dcde3c08c4c398a54c408a76e6dc99d5a3f819a053a6327f0d243a99ac7ed00312c1b2f89ccc737f3d419bc45f8
Sha512	35f31c4dd939da3fdf6271071ec4be84e124f8ee9f0c96a8880fd78345f2a752fee35c27d4a0860d8b6d4a10a3d7e8d9f2b786ce4290d5c8cc150cafd374f9fd
SSDeep	49152:XToxLK+jIhbv8fdFhVdeDq8II42jcGUA2T472fswAEFkTK5qCc5OB3Y:Xe9TAf1wcPTf35kY
TLSH	D02629237DD595A4C1AEDB7688A25516A220B84DCB3173D32E90F7702EB43D0AE7DF21

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x462000 size 8104 bytes