Sign up free
Malicious
Malicious

c63aef8be6c5591befc08c729e759026

Share on LinkedIn
Print
PE Executable
MD5: c63aef8be6c5591befc08c729e759026
Size: 4.16 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d005ab5c6077b137b0c67db6ff7bef1557095d7deba9bd7b8785a1ecf37dccfa
MD5
c63aef8be6c5591befc08c729e759026
Verdict
Malicious
File type
PE Executable · 4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/d005ab5c6077b137b0c67db6ff7bef1557095d7deba9bd7b8785a1ecf37dccfa

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
4.16 MB · 4,164,488 B
First seen
2026-11-03 23:45 · 6 hours ago
Last seen
2026-11-03 23:45 · 6 hours ago
Last analysis
2026-11-03 23:45 · 6 hours ago
Hashes
MD5 c63aef8be6c5591befc08c729e759026 Sha1 1db3bb3bc4076f7038b9ddfd7d17fdc43c3bfa5c Sha256 d005ab5c6077b137b0c67db6ff7bef1557095d7deba9bd7b8785a1ecf37dccfa Sha384 794f357a4b8035a00b43dc2b3e17386c2d936e961ee8ea521478f2c4f9114d7c0e680097595872d389b7a2eb433708b4 Sha512 7d2f062438ff8aaff467f1a4fd5621b41ad2d93e973f07af521a511a3946ef8c380be45215ad04e40b8a377781089707137499955c46eb7a7dbd422bca5016bf SSDeep 49152:xIaCDTK7Id7WohQkvayKrTplOuleQvc9fgmHlI:xQB7FG TLSH A5166B03BDA244A9C0AAE734C9661252B779BC4D4B3163E32E50B77C2F767C09E79B14
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEc63aef8be6c5591befc08c729e759026Go Loader (Factory-v3)
Structure
P7B[Authenticode]_4e351bb1.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x3F6C00 size 8072 bytes
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙