Malicious
Malicious

bf4a34ad22dd4c0ea0f78b43db8a2841

PE Executable
MD5: bf4a34ad22dd4c0ea0f78b43db8a2841
Size: 10.75 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
10.75 MB · 10,753,536 B
Hashes
MD5 bf4a34ad22dd4c0ea0f78b43db8a2841 Sha1 794cf49717de7850c55b34649f6a9fd6485d6b0d Sha256 a3db02c0e0e3d5150e01d3624df625f1b764a43bb5816e9f4dc5ca93d5f2f8de Sha384 816d7b5eca49131730f13d6baf9d6438f4df2ef85f4ffc897e20854d924dc23eb2a2131b83fedd94cba23356d9051797 Sha512 b859f83f0f5a0424e86b193bec09fed2fc531aa787b0a1afc9ddd8115550ea9f3a1850f081359ac2c1f6d30bcf0172a7039890978df11f93f2693c1e218502ed SSDeep 98304:6bpo23big94jZ1wFNdAedFngEgE3mGXL6LMybm1U2E+dSMYoFLaO84v08c2/E638:6Xbr949GNyYboNiUBWHJsPf638 TLSH EDB69C47EDA155E9C0ADD1358A639253BF727C484B3123E32B90B7282F76BE06E78750
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 1 file
EXEbf4a34ad22dd4c0ea0f78b43db8a2841Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes
Name Value
Attribution
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
PE Detect: PeReader OK (file layout)
GoLoader
GoLoader extraction: NotIdentified
1 malicious · 1 file
EXEbf4a34ad22dd4c0ea0f78b43db8a2841Go Loader (Factory-v3)
Structure
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙