Deep Malware Analysis of c1cf157a619f07ebc185ca06c66e433a | md5: c1cf157a619f07ebc185ca06c66e433a | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c1cf157a619f07ebc185ca06c66e433a
Sha1	55acdc80b96eaf54b000026ab113959dc62370d5
Sha256	5f1b647f5d9598f507f55d25c6a1ddb09736b8ad2a2655c3088055121f981341
Sha384	2c7f9d778d91e50cbab7deda834671ea482499afb81fc8e5431d7084821e1ae039afc42c827d6f06350e641bd557033c
Sha512	e8465411a02c1a5eaea38b6c709346270dfbbdf40c2217c8190fdd1da87da395269ebdbeb4699f3145366ba7123e87c87748d062356717247f7db57aef236eb8
SSDeep	196608:PiaGgVL2daNKRVQ9aMBD38gJynrhUprhinMJt1BhrLq4STjoeU:PbD6OKRKugJSNUprhiMzrSPoeU
TLSH	44A6010BBCE148E5C4AE92318A779552BB71BC490F3123E72E50B2782F72BE49E75750

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikontElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)