Malicious
Malicious

ba65f7bada91264a47b4af194b593ced

Share on LinkedIn
Print
PE Executable
MD5: ba65f7bada91264a47b4af194b593ced
Size: 4.18 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0c5b257b8072cdcfa9fb6fff648f5fd5c656d98196d4aeae7d3a9c637e783b58
MD5
ba65f7bada91264a47b4af194b593ced
Verdict
Malicious
File type
PE Executable · 4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/0c5b257b8072cdcfa9fb6fff648f5fd5c656d98196d4aeae7d3a9c637e783b58

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
4.18 MB · 4,176,248 B
First seen
2026-10-29 22:30 · 5 hours ago
Last seen
2026-10-29 22:30 · 5 hours ago
Last analysis
2026-10-29 22:30 · 5 hours ago
Hashes
MD5 ba65f7bada91264a47b4af194b593ced Sha1 6ce96d06ed208c0281893f9600d5f16ce6962cdc Sha256 0c5b257b8072cdcfa9fb6fff648f5fd5c656d98196d4aeae7d3a9c637e783b58 Sha384 392520afb7ab4ad231e11d88327cd0375354748fa933d7783a928e10c6ef7a1258e742fd2c041953715d483fb459c94c Sha512 5ff592f337a4f89153a2a2cc0b2179eb3776068c5a2703c896fa01ac49518237f7cf4bb29a192600424b4fb654e8b845508b82c38bc1bdb101512456802bbf26 SSDeep 49152:X762NiEvBGi80S7S3yjjJ5CfBX4pMLDoo1zJoCFd9uwf:XR25CfBXtLso1dNdnf TLSH 6C167C077EE05AAAC06B9139D4AB1201B7B47C0D973073E71F40BA382E76BD46979F58
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEba65f7bada91264a47b4af194b593cedGo Loader (Factory-v3)
Structure
P7B[Authenticode]_f4e4223e.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x3F9A00 size 8056 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙