Malicious
Malicious

e1dc5a9e421683874d97e888a3b00a89

Share on LinkedIn
Print
PE Executable
MD5: e1dc5a9e421683874d97e888a3b00a89
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a06ad8d1abae72517bf28b45d0a03eee67bea2d309ee7823504e6bcb5d2b7f5b
MD5
e1dc5a9e421683874d97e888a3b00a89
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/a06ad8d1abae72517bf28b45d0a03eee67bea2d309ee7823504e6bcb5d2b7f5b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,572,160 B
First seen
2026-10-28 00:15 · 53 minutes ago
Last seen
2026-10-28 00:15 · 53 minutes ago
Last analysis
2026-10-28 00:15 · 53 minutes ago
Hashes
MD5 e1dc5a9e421683874d97e888a3b00a89 Sha1 3e68bdf6fcfff5c35f452798193b256c23c19955 Sha256 a06ad8d1abae72517bf28b45d0a03eee67bea2d309ee7823504e6bcb5d2b7f5b Sha384 579f775b22a01ba11d0fd559e50454b42e4a97f07ef1ac11acf8339f89c92b549f8bcfd20db5ef6a8221805d59a6edf9 Sha512 195c7c966ba998ea271a9076690335b8c359de14c684d44d78842c640cfaf5d4eb10a9f1444eaee51da01832f555fdc53818b156a7822967587c78ae75b0a11c SSDeep 98304:kh+R39x63rXViKFZdzsEQzg1rp4/G2IflEq:vxUBFjQzgFpROq TLSH CEC65C11FACB54F1F903583140ABB27F23315D048B28CBDBEB547B6AF87B6A1196A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEe1dc5a9e421683874d97e888a3b00a89Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙