Sign up free
Malicious
Malicious

d7417b4823e01915840a374d7ca21426

Share on LinkedIn
Print
PE Executable
MD5: d7417b4823e01915840a374d7ca21426
Size: 5.08 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.8 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5782a83c9afa1995178a80b34f5abf01a2b0feaa34bdc0f98f8319c920287af2
MD5
d7417b4823e01915840a374d7ca21426
Verdict
Malicious
File type
PE Executable · 4.8 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/5782a83c9afa1995178a80b34f5abf01a2b0feaa34bdc0f98f8319c920287af2

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
5.08 MB · 5,084,120 B
First seen
2026-11-03 23:45 · 6 hours ago
Last seen
2026-11-03 23:45 · 6 hours ago
Last analysis
2026-11-03 23:45 · 6 hours ago
Hashes
MD5 d7417b4823e01915840a374d7ca21426 Sha1 6d5999fa4f50211937d9d0157fb4ed2bdaf64318 Sha256 5782a83c9afa1995178a80b34f5abf01a2b0feaa34bdc0f98f8319c920287af2 Sha384 e9015e2c77cab11fb053cd586dda99d7e83fb335ed6a36eaca35b766a9956123dcd63d3065cce848bdef2ff13c7a1019 Sha512 56baad9809b54c6c27ac7da994946d0302143d4cdc27a1676f006e0dc8cbac349255a2e4f9b959de8d3fafa0eb05509530c2ca344fa5f01b670247d3ca107fbd SSDeep 49152:us9dK5ajgI/Eof56pVUamPNdBQRIO755lcp+ef:uwZxWIEvqf TLSH F6368D13EC9590AAD19AA930D8B241137B55BC5CAF3233F73E40BA341F367D0A6B6B15
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEd7417b4823e01915840a374d7ca21426Go Loader (Factory-v3)
Structure
P7B[Authenticode]_a5f81a14.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x4D7400 size 8152 bytes
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙