Malicious
Malicious

c73d9426c8022286448edb4ef70d4f19

Share on LinkedIn
Print
PE Executable
MD5: c73d9426c8022286448edb4ef70d4f19
Size: 4.19 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
36d1df281dd56854a0997f3da0627a8cffd4b3f8ae2449db4d2b7d0caaf16ca9
MD5
c73d9426c8022286448edb4ef70d4f19
Verdict
Malicious
File type
PE Executable · 4 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/36d1df281dd56854a0997f3da0627a8cffd4b3f8ae2449db4d2b7d0caaf16ca9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
4.19 MB · 4,192,632 B
First seen
2026-10-29 22:30 · 5 hours ago
Last seen
2026-10-29 22:30 · 5 hours ago
Last analysis
2026-10-29 22:30 · 5 hours ago
Hashes
MD5 c73d9426c8022286448edb4ef70d4f19 Sha1 6656e9cd8197bea86d8568abac499ef813cab445 Sha256 36d1df281dd56854a0997f3da0627a8cffd4b3f8ae2449db4d2b7d0caaf16ca9 Sha384 a85adaa8c4d5260468133cbc871e69fe6fc2fa4ae94673a7cdb39f2226d2333700832e47b7d73732b4628cd159ce41dd Sha512 af52f7015e933fac9a366b9645a78316969956920493892d0f4144b042239180ae15ea8cf44225fea3818a34ea443d2c022eb5fef26f28bc425304ce6656433e SSDeep 49152:fS7sW8uovIbjsPI1i1c0m9FSCoeG6NycFsRJWApdutlwupx:fZ9yYReGbc2RU TLSH CA167C077EE45AAAC06BD139E0AB12117BB47C0D973533E31F40AA382E767D4A979F14
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEc73d9426c8022286448edb4ef70d4f19Go Loader (Factory-v3)
Structure
P7B[Authenticode]_da1dd85f.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x3FDA00 size 8056 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙