Deep Malware Analysis of c79fd7ae32f88a183aa40ba8d6b266c0 | md5: c79fd7ae32f88a183aa40ba8d6b266c0 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c79fd7ae32f88a183aa40ba8d6b266c0
Sha1	c1dc6af2ce2995a9721e1959c7f00ee832497af5
Sha256	61fcf11e431a34c80d90e8af7f1d6b11eed82397ad21cc986648af0ffeb7e4d3
Sha384	8f2bcc98bf8ef7d0b365ba3b912cdc39c3bfb6c3b9d91ff622535d48a7eef5e91fed9986643268f9fd89c845b41244d7
Sha512	9b2374d5e82928c604d5c5e209fe9dfd5889dd2e7d878fcb077becfdafe3178d19cfbfb50bd4e936ecfb3a0a8a4dcc175e4ff3cdcd8cf51142fe353d174b5fd2
SSDeep	49152:svNP0wB6rJBAgTZKW8iyyaluQ7z35x0bR9Ozjc5EBcLJPb4h5J3:sF6BVWpx0zEqND4r
TLSH	21464A07FCA549E9C0AED635896692537A71BC485B3423D72F60F7382F72BD0AA78740

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055

Shape pe:exe

malicious 1 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)