Deep Malware Analysis of c3a88070efbd17199ccd5debc34d649a | md5: c3a88070efbd17199ccd5debc34d649a | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c3a88070efbd17199ccd5debc34d649a
Sha1	452d6d2e7e2beccc6c7bff245529736c3d864894
Sha256	be000b0dbf3e8430af3837368751ee1337ffe696d1935d7865eae1684141ff6b
Sha384	88c97e3aa0194dea9a5cf34a720fcd80ab48a229fefcfe2856fe36cc4b8af843e7b38fa7a12c2b473156d83a298865ee
Sha512	1a3ae1e97472c073ee417eb414e35eb7ba2be241d116eb9be05820da7061ecb90a1081de0054bbda6f9b4d0204fef12d8bde3c2694c6d50e8ba5e721c84f315f
SSDeep	98304:3NGcxrgplbuMQXgCDwu2E1NM7m1RPUL7H27L89grD7gKvgnSn8mf:3Nzg7uMWX1NYm1R07H27L8qH754k
TLSH	2A868D03EC9159EAC1AAE23189B39253BA717C446B3227D32B90F77D6E77BD45A74300

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)