Sign up free
Malicious
Malicious

d585ebffdd275589c3b8958a26421d7f

Share on LinkedIn
Print
PE Executable
MD5: d585ebffdd275589c3b8958a26421d7f
Size: 4.9 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.7 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c296507290645a756e4803bb5a51bf913fd27085b82c2fbacd71b8c7332838ab
MD5
d585ebffdd275589c3b8958a26421d7f
Verdict
Malicious
File type
PE Executable · 4.7 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/c296507290645a756e4803bb5a51bf913fd27085b82c2fbacd71b8c7332838ab

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
4.9 MB · 4,902,280 B
First seen
2026-11-03 23:45 · 6 hours ago
Last seen
2026-11-03 23:45 · 6 hours ago
Last analysis
2026-11-03 23:45 · 6 hours ago
Hashes
MD5 d585ebffdd275589c3b8958a26421d7f Sha1 8319628e918975c3bede48c380fa1591da5be368 Sha256 c296507290645a756e4803bb5a51bf913fd27085b82c2fbacd71b8c7332838ab Sha384 ec81b4dd9bd34d2a5d466b202f12b47899b31f129a47dce99ffbec2c1500374153fc299da443843d743ee2ce9dd4f427 Sha512 9b8365a8fa9f3c538e5ac8e9273e63d7b31b5c85e74fe54f8c3deb89456c4038ca591c9dc0e4d934de5dbf3e8a6ffa391c093b2d1708af455e177b6be04bae67 SSDeep 49152:9YNcrvreq8ZIpPlfYDLhQUYuOEQ994VSOX+5FSmRe+f:978IS/+5jz TLSH 24365B07BDE145A9C0AAD738C4671252BBB87C4C4B3563D32F10BA782E763D09EB9B54
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEd585ebffdd275589c3b8958a26421d7fGo Loader (Factory-v3)
Structure
P7B[Authenticode]_1225f85b.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x4AAE00 size 8072 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙