Malicious
Malicious

dc40fa9a9e1d3c1a38ba6aabbfbd4df2

Share on LinkedIn
Print
PE Executable
MD5: dc40fa9a9e1d3c1a38ba6aabbfbd4df2
Size: 5.61 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.3 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
999241465efec665590ab701c22b0c6133163d28abb9335854d5d7475ff5e3df
MD5
dc40fa9a9e1d3c1a38ba6aabbfbd4df2
Verdict
Malicious
File type
PE Executable · 5.3 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/999241465efec665590ab701c22b0c6133163d28abb9335854d5d7475ff5e3df

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
5.61 MB · 5,605,280 B
First seen
2026-11-01 15:15 · 4 hours ago
Last seen
2026-11-01 15:15 · 4 hours ago
Last analysis
2026-11-01 15:15 · 4 hours ago
Hashes
MD5 dc40fa9a9e1d3c1a38ba6aabbfbd4df2 Sha1 070108baea00260a22aef62d22d9fa8432d8cfde Sha256 999241465efec665590ab701c22b0c6133163d28abb9335854d5d7475ff5e3df Sha384 93cf22a2e0f0e0c227fef22164d3e28541a7d2e71bcf9c8cd2842d65598c13119bceb8571231691370039754d4b1a048 Sha512 4028facac3789b4342bbc2ae253de596510e1ff1b5624921f31ec5da264422349b696fee8b415afd3f30b9bd24ea6db8328d5acf06836405ac8dba3374e969ff SSDeep 49152:iAAkBnn+siUvAsdUuVPTbCykFG0zDtGp3TPCm+mjo9B/6hVZz9abJPxqPN:iHAPPCm+mMMhVlGC TLSH 2B467D03EDA154AED49AA334C9A752427BB47C8C6B3173D32F40B6382E767D05EB9B05
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEdc40fa9a9e1d3c1a38ba6aabbfbd4df2Go Loader (Factory-v3)
Structure
P7B[Authenticode]_e3c4322a.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x556800 size 8096 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙