Deep Malware Analysis of d9abf20fe61f5ffee3a3ac6ba7276e63 | md5: d9abf20fe61f5ffee3a3ac6ba7276e63 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	d9abf20fe61f5ffee3a3ac6ba7276e63
Sha1	6fc371b5e8471792eaf1883a8439c93eb89cbd83
Sha256	70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811
Sha384	461f4c21a006abb109091438b8d841afdbdb3c9f02f57a32ff4c1772ff8bfe267e340d194cadad9f8ec2fec2fbfd18f7
Sha512	e3d7e5d0e686c895fa52c3d29c5f79d403157930561a5707c8344034fed0753375f9f072ca3a689e47c7f77ff76dee1e4acfb5f17b08b0ac7a92a39d9c061d20
SSDeep	49152:HkfA+suMKdVaudZIY20aMEnr8U44/CO2LH7:HB9+ZfbCILH7
TLSH	29069D03FDD15C79C1A563328AAA5291B73CBC855B2223C72E90B37A3EB77E05836754

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x3A6E58 size 2400 bytes