Sign up free
Malicious
Malicious

dd40a776e6ca00d9ca8bd3cb06e2b8b7

Share on LinkedIn
Print
PE Executable
MD5: dd40a776e6ca00d9ca8bd3cb06e2b8b7
Size: 5.9 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.6 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0da518a8446bf832d527a9859d96753b6740f9ae1991e0ca72c928f3fc46dec7
MD5
dd40a776e6ca00d9ca8bd3cb06e2b8b7
Verdict
Malicious
File type
PE Executable · 5.6 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/0da518a8446bf832d527a9859d96753b6740f9ae1991e0ca72c928f3fc46dec7

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
5.9 MB · 5,895,120 B
First seen
2026-11-02 23:15 · 9 hours ago
Last seen
2026-11-02 23:15 · 9 hours ago
Last analysis
2026-11-02 23:15 · 9 hours ago
Hashes
MD5 dd40a776e6ca00d9ca8bd3cb06e2b8b7 Sha1 adf03b3cea35bbde094e1b7fbeea6eedd674030a Sha256 0da518a8446bf832d527a9859d96753b6740f9ae1991e0ca72c928f3fc46dec7 Sha384 2053dfba1d63d54106be3f85f9f16d3b5396a81ce5763e3a35f49928edafdf3c392586a465001f21a36d3fc4d9989419 Sha512 e91c50f15a452d9da0fa829296b96120a1d28a632e03863bbc5ec9c350ed66f40df531b6f1efad335c3b13bd0a8366b9df4d7a74998bd18c327187bb176c58a1 SSDeep 49152:Y9BjsMawE7iVvd5UOeQHX6KD3Jk48/CGgeRZ3sccOQoPd7S7plBr9S2W0l31:Yywz5+kOQIApfqu TLSH 39565B03EE6504EDC09AEA70C9A796137A64BC4D8B3133D73E54BB742F267D0AA78705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEdd40a776e6ca00d9ca8bd3cb06e2b8b7Go Loader (Factory-v3)
Structure
P7B[Authenticode]_270734b0.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x59D400 size 8144 bytes
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙