Deep Malware Analysis of ddcb54e51f446b060df915ccc11c97c1 | md5: ddcb54e51f446b060df915ccc11c97c1 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ddcb54e51f446b060df915ccc11c97c1
Sha1	78881f92f5d751e0ebcfa46dc622c7ca3ae15cf8
Sha256	746bcde604a2cf29d98c06143934a1db4b767b99aa50dc21c2e71e640437823b
Sha384	1194f81d46ee718f5a71c04ed0e1f6984e87721f40b71f19f6b74f569555792094bada9580d037d3cb8d06e666c36014
Sha512	e6f9e341f159c105f6542576e2fa541ba5eeea73fbdcfdfc09f49f06149b5b3172d7372929a5279e6cf985ad440da0cee7315608fb339c42653dc41350b0cfc6
SSDeep	49152:5PZqXvRK/b6EQvcrxgFYEDRlsdHRssWUYhhTNR17o5:5BbrMRoW3LhhTI
TLSH	77562817B98010E8C98A877588F44A6767717CAE5733A3CB0F60F6B42F277D56A34B48

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12tElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x5C6800 size 8152 bytes