Deep Malware Analysis of e132bb34e0b737ff9f7acbd935c5aebb | md5: e132bb34e0b737ff9f7acbd935c5aebb | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	e132bb34e0b737ff9f7acbd935c5aebb
Sha1	b48bc8f610d5834ccca3b7c6d9854b6ddf103efb
Sha256	a9892231ad0534bac12f3bb619d3a4497aaf52d1c8b7183bcd985ec0c4c10eaf
Sha384	e3872e99803756d658a940c0f4e1d6c7165603aec3399c934a59a04d0ae70eeb40d015afd1f0275d458db5cdd17e3c58
Sha512	e5094e640e041f4b8da2b9b5321c5968ccd48f9e82e1777ac3ed22e01a782923f228ce3aa090d75de71023383d40f6669e49e8d72eba6d2b41d2f2106fdf4813
SSDeep	24576:C2RnGOyC1esXQJSwXEhDT2Uz8OYt5Zv25BKBy8bLOVyOu4/8KVhgzDfyN4w/BFRD:CAnGxC1jwI/2hK5BKB4Vnjj8w/3R
TLSH	4AD549067C418269E5A65B35C9AA95A2B571BC4C8B3373E71F80AB302F333C39D75B58

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x2CB400 size 8104 bytes