Malicious
Malicious

d22f02406ecbef2f0af8353218c35ee0

Share on LinkedIn
Print
PE Executable
MD5: d22f02406ecbef2f0af8353218c35ee0
Size: 4.74 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.5 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 21 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5515a2ce2c2622302888667bad60ae1820d0c8790ab96b851d5fd1544304b63a
MD5
d22f02406ecbef2f0af8353218c35ee0
Verdict
Malicious
File type
PE Executable · 4.5 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/5515a2ce2c2622302888667bad60ae1820d0c8790ab96b851d5fd1544304b63a

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
4.74 MB · 4,741,120 B
First seen
2026-10-31 12:30 · an hour ago
Last seen
2026-10-31 12:30 · an hour ago
Last analysis
2026-10-31 12:30 · an hour ago
Hashes
MD5 d22f02406ecbef2f0af8353218c35ee0 Sha1 79771f4e091def45d80eeb53ff779024e951f635 Sha256 5515a2ce2c2622302888667bad60ae1820d0c8790ab96b851d5fd1544304b63a Sha384 8a76a10b8c1252a9ff1aad2a8ba172061a5ca4244bf54036d4f460d9c45a7b3aadd87e96b01607960041f652d3a990aa Sha512 24434d99ec8a2841f0e0181ecab5e40286e3e0033e668fb504e1e84a9888917bbfa8edac0fb731274f6cc48936eb9686ba7654f2490b51db32fc37a16fc77552 SSDeep 98304:IZ/5mTI2ORQZExXFgzjLhyMpUMFNLe+Ugz8:I2k3QrjLgEUMb0y TLSH 7026CE17BCF508B5C4AE9236D9A295537A74FC444F3227C33A58B3692F72BD05AB9308
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 22 files
EXEd22f02406ecbef2f0af8353218c35ee0Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙