Malicious
Malicious

b34a9b6df14480d814f9ff25e6d631bd

Share on LinkedIn
Print
PE Executable
MD5: b34a9b6df14480d814f9ff25e6d631bd
Size: 12.57 MB
application/x-dosexec

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
15c64ba71c39dae1862eb9b9f2e4bd663d2e941494aaf05e9c84e9594d299c1d
MD5
b34a9b6df14480d814f9ff25e6d631bd
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/15c64ba71c39dae1862eb9b9f2e4bd663d2e941494aaf05e9c84e9594d299c1d

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,570,824 B
First seen
2026-10-26 00:16 · 37 minutes ago
Last seen
2026-10-26 00:16 · 37 minutes ago
Last analysis
2026-10-26 00:16 · 37 minutes ago
Hashes
MD5 b34a9b6df14480d814f9ff25e6d631bd Sha1 46a456c4895b6ab70064ad23bd0681c319a93338 Sha256 15c64ba71c39dae1862eb9b9f2e4bd663d2e941494aaf05e9c84e9594d299c1d Sha384 5efa951bfc332c0632ca3f2eab752ebbc5ffb3f8c7abe223a46dcf68c49846f18f94ed53c1a87bf77f6758b6a379602d Sha512 0246e931bbad5861fd6fe62b7cbba3933c632a1da824cbab5438ccea4d36de87c0880669cdf79b85a03c4ea9733e3fd9c44fa8bb610413188224661f825c3467 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+J:yBkKr5rszpNDy+J TLSH 22C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 1 file
EXEb34a9b6df14480d814f9ff25e6d631bdGo Loader (Factory-v3)
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙