Go Loader (Factory-v3) malware analysis – 38dbcfe9e766

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

6.8 MB · 6,801,296 B

First seen

2026-10-08 23:30 · 16 days ago

Last seen

2026-10-08 23:30 · 16 days ago

Last analysis

2026-10-23 19:26 · 2 days ago

Hashes

MD5 e136fadd3494833f1c7d073df3a0772f Sha1 91f5336715a543f9cbc45cbda6471b2a38aba4b8 Sha256 38dbcfe9e766a0b1a15c90e021febb42d75fd103328a6e1361fbb75ea1664f7e Sha384 db407faac23bcb80786db69b9c65ae7d96f72d95948f5d86c723791164c06769af5135a703c70da9888fa34b2cc131a4 Sha512 c81f4ffaced4bfd1aa35b62415708b55facd2c0940abbd7ff511df483be9390d03bc27dc2f83a28e6219e849bbd0d7d15ec48877172f27294ee9c508d8505d39 SSDeep 24576:VV/Qr/6Rak++7O66NIaopqaDckeDfym+wp8SGXkMStf5yWmWk:VV4r/6wk++2NSwewpQBSmV1 TLSH 8666D85871C410EDCA8E837648F45DBE23B21DBB1613A78A0799BBE12F13BD65F24D48

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 3 files

EXEe136fadd3494833f1c7d073df3a0772fGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

P7B[Authenticode]_ca6884dc.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 1391616 bytes, sha256 e68827872173648907faa205b6c0a8d379b3d6d68fd9afd3ee8703c71c113ddf, Go/decimal-splitmix64 -> segments:8154 -> state-le:68bc4c7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64`
Info	Authenticode present at 0x67A800 size 8080 bytes

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

GoLoader

GoLoader payload 1: 1391616 bytes, sha256 e68827872173648907faa205b6c0a8d379b3d6d68fd9afd3ee8703c71c113ddf, Go/decimal-splitmix64 -> segments:8154 -> state-le:68bc4c7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64

Info

Authenticode present at 0x67A800 size 8080 bytes