Deep Malware Analysis of c70b058564a67317ac7d3e535f2f6e64 | md5: c70b058564a67317ac7d3e535f2f6e64 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c70b058564a67317ac7d3e535f2f6e64
Sha1	c6d375297c7906d9afeaa7edcc844a35cf0df053
Sha256	8aeff0c7ac9eab60e3eb8038d0a6bcd6c1a3fd6de70faef0721cf6fe2223e92d
Sha384	e5cb7783bb28b768d4eed1f56f40fb7acfd044bf4db93aa9615ae135dcfc9dad480ef723ada3b4ed05a67061b67e57f8
Sha512	1d2749ba2385a7bcb196e49e29cd8d2e854031e1aa3af93704a2b4289bd0534551f76487c7d869b29efd9b1374d48fbf0db4d92c2ea9c0fd25b2a522b542b915
SSDeep	49152:Tci3rUevkXc1dX4T+cun8FRyVY6RMguoo/7NWYPa1KSdeSHbhMn+T2tBJjcAulJq:r3rUe3DKyVYbTz/Bnn+TxJVzJ
TLSH	C3663A41FECB85F6EA031831506BB27F57305E058F24DBDBEB947B1AE9772821836249

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)