c68f21e42213ff358666c54ea35cbe15

PE Executable

MD5: c68f21e42213ff358666c54ea35cbe15

Size: 17.05 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

17.05 MB · 17,054,344 B

First seen

2026-10-13 06:30 · 12 days ago

Last seen

2026-10-13 06:30 · 12 days ago

Last analysis

2026-10-23 19:23 · 2 days ago

Hashes

MD5 c68f21e42213ff358666c54ea35cbe15 Sha1 cc92e3e6eb66757a3073bb78cf3b6955afdeb360 Sha256 e41e5fd90907e2f57edd2416191a3a21c699a08cec54e60723ae6409b871d663 Sha384 f0c05e9de4d9266c38ecfa2ee56eed9458279bb50fada6bd400be63211bca8babfd7790d6d8c5e7426ebec3b3323239c Sha512 9f8c163ccc1e998e718cdf4bacf93c544950da39962c72cc9880b26c97209f6c728ddeab89a4e393b5a347808914db3f695b59966654732fd30e1abde222d5cf SSDeep 49152:5opNl4JDhvs6qVGUOj8ZaJ90tm0DjCkyIAi:5m4lmGUOQaJ901D+vG TLSH 68079D0A6CD009EAC06A63328DB762917B76FC491F3227D72E60B2782FB67D49D75314

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 3 files

EXEc68f21e42213ff358666c54ea35cbe15Go Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

P7B[Authenticode]_0911fb39.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 856576 bytes, sha256 53f210a37da269d0bb2427db94b12f3d8c5bcef1593cf284f4ec040a220e90d6, Factory-v3/five-pass-legacy -> seed:0x3d93 -> literal-prefix: -> initializer:0x89bb4 -> trim-end:512`
Info	Authenticode present at 0x1043200 size 2184 bytes

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

GoLoader

GoLoader payload 1: 856576 bytes, sha256 53f210a37da269d0bb2427db94b12f3d8c5bcef1593cf284f4ec040a220e90d6, Factory-v3/five-pass-legacy -> seed:0x3d93 -> literal-prefix: -> initializer:0x89bb4 -> trim-end:512

Info

Authenticode present at 0x1043200 size 2184 bytes

2 malicious · 3 files

EXEc68f21e42213ff358666c54ea35cbe15Go Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

P7B[Authenticode]_0911fb39.p7b

No malware configuration was found at this point.