Malicious
Malicious

d554f1c662fec3143dc5825821092576

Share on LinkedIn
Print
PE Executable
MD5: d554f1c662fec3143dc5825821092576
Size: 5.47 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.2 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a65f97f80057034dbbf51b93183d5d4b889ce2c3c3803ec42a2f647f5c72bb11
MD5
d554f1c662fec3143dc5825821092576
Verdict
Malicious
File type
PE Executable · 5.2 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/a65f97f80057034dbbf51b93183d5d4b889ce2c3c3803ec42a2f647f5c72bb11

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
5.47 MB · 5,470,720 B
Hashes
MD5 d554f1c662fec3143dc5825821092576 Sha1 76c1e17bc10f345a296a0c931f6edf3b247f043c Sha256 a65f97f80057034dbbf51b93183d5d4b889ce2c3c3803ec42a2f647f5c72bb11 Sha384 e462afff173c6b8266532866d6afdc60c8747bce98e286efa91fa78057da2920d0aa08682e70d752e416c8bb283d44e1 Sha512 6d6fda44c370182b1efede5bb6c8bb923f20351c77f28ab753ec5a06a2afc57b3e7e96b4ef00402adb9f7bdc85c0ec882720556646f069890ee7aab92d568bf5 SSDeep 98304:Gy/V5L76xAQKQkSIDsaLQPKhJgd+nHScPR12L:GSTvaJKQk+aLQWgjcPR1a TLSH 7B46DF57FCA149E5C0AE9231896295827BB1BC451F3123DB2EA0B7783F72BE06D79710
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXEd554f1c662fec3143dc5825821092576Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙