Malicious
Malicious

d3d30f6508bb457a8ee4ca7728dcb071

Share on LinkedIn
Print
PE Executable
MD5: d3d30f6508bb457a8ee4ca7728dcb071
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a0e40567792fb08aed0345648aa3cb00e6df1144e5008134bfa5b5f7f6c0d40b
MD5
d3d30f6508bb457a8ee4ca7728dcb071
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/a0e40567792fb08aed0345648aa3cb00e6df1144e5008134bfa5b5f7f6c0d40b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,894 B
First seen
2026-10-26 01:32 · 43 minutes ago
Last seen
2026-10-26 01:32 · 43 minutes ago
Last analysis
2026-10-26 01:33 · 42 minutes ago
Hashes
MD5 d3d30f6508bb457a8ee4ca7728dcb071 Sha1 842a3ed51b9f75324d9105734647c21e418b01fe Sha256 a0e40567792fb08aed0345648aa3cb00e6df1144e5008134bfa5b5f7f6c0d40b Sha384 9a1371d52447c84a294eb477d6efc07318ff4bf4948706f776c1b028e9f7a4812a417eb2fa852247b629374ff3b1b66c Sha512 a4d2efbff2b319e8039e8c3fd22b6c9ec02bf34d4febdddcfb08a1a9bc0b09df0016a10c14ac666d1ccbbd2ecdadecdf06fd1c0c18662ebe1fdc736e315007bb SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+g:yBkKr5rszpNDy+g TLSH 1CC65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEd3d30f6508bb457a8ee4ca7728dcb071Go Loader (Factory-v3)
Structure
BINOverlay_23604a79.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_23604a79.bin (270 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙