Malicious
Malicious

b58aaefad6079e788938cff0cb9abb09

Share on LinkedIn
Print
PE Executable
MD5: b58aaefad6079e788938cff0cb9abb09
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
e2aec7a1b6170d673eac421fb245bf445cd28ffdcbb28ffa7d635345a8bf3786
MD5
b58aaefad6079e788938cff0cb9abb09
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/e2aec7a1b6170d673eac421fb245bf445cd28ffdcbb28ffa7d635345a8bf3786

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,570,624 B
First seen
2026-10-28 00:30 · 18 hours ago
Last seen
2026-10-28 00:30 · 18 hours ago
Last analysis
2026-10-28 00:31 · 18 hours ago
Hashes
MD5 b58aaefad6079e788938cff0cb9abb09 Sha1 2ef381477c9db097aae7360829a8d78c6c39f035 Sha256 e2aec7a1b6170d673eac421fb245bf445cd28ffdcbb28ffa7d635345a8bf3786 Sha384 08477aff1f4cc72d3b2e8c475c15d4404b572a7af7a5c33aaca8f4ac843ea4199b4d7cd8a74fb82231d9bbed71d50c64 Sha512 234515f8b59947bcda7b14737cff406a7a7887c6c429e1a88ff88ab8a5df143e4067ef966dfb97071da3b4d9999c8fc4d13b05b5bc381ce6b64648a864642912 SSDeep 49152:ZpXZKft05HtyvruRo9JBDRHCTdU391KX1NbNV4L6d+NTPeGFPbQuhHEPAw8sWAsB:PZ0tkRorxxCO3ukFJFzAoaU4aeEl TLSH A2C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEb58aaefad6079e788938cff0cb9abb09Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙