Malicious
Malicious

ddcb9e5c6b2ca7f053bcfb6d2a654e7b

Share on LinkedIn
Print
PE Executable
MD5: ddcb9e5c6b2ca7f053bcfb6d2a654e7b
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
863b07e707af08201e4bf064eb3a6d2c8b180b6827b22364d35e8d487cc371a3
MD5
ddcb9e5c6b2ca7f053bcfb6d2a654e7b
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/863b07e707af08201e4bf064eb3a6d2c8b180b6827b22364d35e8d487cc371a3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,810 B
First seen
2026-10-28 04:30 · 2 hours ago
Last seen
2026-10-28 04:30 · 2 hours ago
Last analysis
2026-10-28 04:31 · 2 hours ago
Hashes
MD5 ddcb9e5c6b2ca7f053bcfb6d2a654e7b Sha1 10d3fdc16e07368bfe26557b699efdaf398aff71 Sha256 863b07e707af08201e4bf064eb3a6d2c8b180b6827b22364d35e8d487cc371a3 Sha384 31ac7927a420e1c29ee68560a5d106cca0447417dc9243a9ff273e0e04a9194e03c6fdafd2c78c125202fd9bb85210ce Sha512 3a84ddbcb17300e8323807d51fff553e128b940cd67ee1dc60e8a9359749b5d5d327c320641eb16bd02b1dfa6406e634589832884fd5090367757e5460c5f86a SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+O:yBkKr5rszpNDy+O TLSH 18C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEddcb9e5c6b2ca7f053bcfb6d2a654e7bGo Loader (Factory-v3)
Structure
BINOverlay_08ffce5d.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_08ffce5d.bin (186 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙