Malicious
Malicious

d1042b1f26168892ea07f5aa99813dfe

Share on LinkedIn
Print
PE Executable
MD5: d1042b1f26168892ea07f5aa99813dfe
Size: 4.83 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.6 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
6fa0c00964f79fcd4f5b03053513b6e199a8fe864b8c0b5d46826d2ca396394c
MD5
d1042b1f26168892ea07f5aa99813dfe
Verdict
Malicious
File type
PE Executable · 4.6 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/6fa0c00964f79fcd4f5b03053513b6e199a8fe864b8c0b5d46826d2ca396394c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
4.83 MB · 4,829,608 B
First seen
2026-11-01 17:30 · 2 hours ago
Last seen
2026-11-01 17:30 · 2 hours ago
Last analysis
2026-11-01 17:30 · 2 hours ago
Hashes
MD5 d1042b1f26168892ea07f5aa99813dfe Sha1 3192ac18e05acb59f565349ee14333fa9ce0e1c5 Sha256 6fa0c00964f79fcd4f5b03053513b6e199a8fe864b8c0b5d46826d2ca396394c Sha384 adb17d320329e242df0f2543b1a545596a7b02c7b4c11a4237e7b6bde6e0c02ca40d3e6f3df674c3d90b6fa7659aeb4d Sha512 6383f9cc79c0b68fbb81c939d447b8cbe46ffacd767f8bb63b2ba4513a43f6eb8ba577cc8295a79964e75449cea864246125a79cd72b4ad2c612cd65571b3499 SSDeep 24576:U5NVcK/cTgQInwPmjM0f/JVi13q3/ykIIkIOKLVh0maheMu9XzYSjvAxTV2GXjEU:U5N6K/CIwPmI0f/JV43qdFzgQMbP29q TLSH A1265A13FDA254AAC4AAE335C5A742527B757C8C6B3163D72E50B3382E367D06EB9700
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEd1042b1f26168892ea07f5aa99813dfeGo Loader (Factory-v3)
Structure
P7B[Authenticode]_b6f7a308.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x499200 size 8104 bytes
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙