Deep Malware Analysis of c672f58d835a632afc26bff6f731c51c | md5: c672f58d835a632afc26bff6f731c51c | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c672f58d835a632afc26bff6f731c51c
Sha1	a26f18194ca6e642306913b53017a0bcae8e0dd3
Sha256	c9adf76bfa8e460ae8c765c0f1c002a1829cec45a7860d8c45d922d434e99ccb
Sha384	5d44a5328b024456934d49c0aa1e013ea813a3e312bfa121393b002063ecb52a58a5aa3e02b63955b675278f1992fb31
Sha512	12e66567367afb3c24f0b1669c6aaeef24413e8db1bb5b98ea2d809586f068cc380b4d03bb7ecf6f5b5f9678c2178ac6aab18fc913772e3d766e8a4a89a5aef4
SSDeep	98304:7go2OP2iBgY+6Oi7Sl/kLie5L9FTS5Fyaq:752DT488T
TLSH	FA06AF037EA545A6C06AE336C87721627A75BC4E5B3233E72E44B7782FB27D05935B08

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3C1600 size 8056 bytes