Malicious
Malicious

d30f31863da1dbcade2cde7129886908

Share on LinkedIn
Print
PE Executable
MD5: d30f31863da1dbcade2cde7129886908
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d38888ef13080bcf9a5ab92f19a4d3f2bf72860429216fa21db591f716f88ad0
MD5
d30f31863da1dbcade2cde7129886908
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/d38888ef13080bcf9a5ab92f19a4d3f2bf72860429216fa21db591f716f88ad0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,863 B
First seen
2026-10-29 02:30 · 40 minutes ago
Last seen
2026-10-29 02:30 · 40 minutes ago
Last analysis
2026-10-29 02:30 · 39 minutes ago
Hashes
MD5 d30f31863da1dbcade2cde7129886908 Sha1 711d062fa87ddfd9a82d143ef4e6fa6e499c8da9 Sha256 d38888ef13080bcf9a5ab92f19a4d3f2bf72860429216fa21db591f716f88ad0 Sha384 8652bd4a413fae8579f5ad56a42dd73e9e6ce89444ce4d374d80ee1aa869b164f497d5c0db2e330e66d5ebebd18810dc Sha512 f14a676b375f4c103afd7555e439be9c227f20fa9ed94e1641b07bae1dfbaa16865a2abe8c3ec0ef21a10b159e9c5b2ff9901eee19417184b330d92e416f3ebf SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE++:yBkKr5rszpNDy++ TLSH 70C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 1 file
EXEd30f31863da1dbcade2cde7129886908Go Loader (Factory-v3)
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙