Go Loader (Factory-v3) malware analysis – 99b335ac5caf

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

4.31 MB · 4,314,488 B

First seen

2026-10-21 11:31 · 4 days ago

Last seen

2026-10-21 11:31 · 4 days ago

Last analysis

2026-10-23 19:08 · 2 days ago

Hashes

MD5 b561ca3efaffdd14d079c5b92a66e22d Sha1 964d20f7c7f0a4cf8378e51577ff5dd1ab2e5fce Sha256 99b335ac5caf5249edc3223b100517d72f4fec0c6012955e3efc8d56c96880ef Sha384 7145e0189d4a7fc52e2098a662af0aad4ca60e3d5143506d1cca348c5c92a68cb2e7379d6d2346e4c405b59622139d82 Sha512 e436ddeabbe66f6e611c20ada96996318bd7fdf12249957ef1ce295c37c91df2508c5cda957d8c844a4c8c9e79afd3886592b5431c4202b9f1b8ab9b0b885419 SSDeep 98304:1fX7MuUPwzmynC7FrQA9eQQrE80AiJcpYXx4Oe:1P7M6JAjk4s TLSH 00169D07BF9582A8C096E339C4B642427671BC5D8B3123E72F44BBB41E727D19A72F58

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXEb561ca3efaffdd14d079c5b92a66e22dGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_e980aca7.bin

P7B[Authenticode]_7168872b.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 1419801 bytes, sha256 6600756625cbd221336f812bea8cba6f3f6a444c25f84578051dacf04d1be729, Go/affine-five-pass -> literal-prefix:acb5e2c206fc0d1427 -> initializer:0x183ffe -> subtract-indexed:bias=3;index=31 -> Reverse -> subtract-indexed:bias=-25;index=13 -> SwapAdjacent -> subtract-indexed:bias=-113;index=7`
Info	Authenticode present at 0x41B600 size 8056 bytes

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

GoLoader

GoLoader payload 1: 1419801 bytes, sha256 6600756625cbd221336f812bea8cba6f3f6a444c25f84578051dacf04d1be729, Go/affine-five-pass -> literal-prefix:acb5e2c206fc0d1427 -> initializer:0x183ffe -> subtract-indexed:bias=3;index=31 -> Reverse -> subtract-indexed:bias=-25;index=13 -> SwapAdjacent -> subtract-indexed:bias=-113;index=7

Info

Authenticode present at 0x41B600 size 8056 bytes