Deep Malware Analysis of e679c84bd93c7d1eb9c45f9da590010b | md5: e679c84bd93c7d1eb9c45f9da590010b | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Size

4.26 MB · 4,264,384 B

Hashes

MD5 e679c84bd93c7d1eb9c45f9da590010b Sha1 dcdeb963a57fef605e253b78eae083dc612459ba Sha256 6cd76d867cf850f6c638840a199f34d30e16200c9f065dfcffad973aed173bc3 Sha384 4fae28ed4619fa840e6f09f397cf49f1e81f886fee1a31c5186a988e04a36d0d8b6fa8124800b39b49a1465311a06cb0 Sha512 d368fea8b97eac3b35be8676dc14449153b82a0c1427201e03e2ea7bfc68f34ffa01f5f77bf4ae0710c8be199757692b3065d6af20e6d49e77c4d43e53523431 SSDeep 49152:PVBUL56T+RHGVzAgeQs5guovJ/CZgIWb3/vwk0Yq:P45Kl5HAOIWc6q TLSH DC1629077B5994A5C09AFB3089662B22B771BC4CD33533D36F9066382E72BD1E9B4B14

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 5 files

EXEe679c84bd93c7d1eb9c45f9da590010bGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_c95fa4c3.bin

BINResources

P7B[Authenticode]_a67dea50.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 273201 bytes, sha256 1fe0731fc791a6a6b8e3e1a04b07a001f222e7bd7259d9ff9a55de091c7cb152, Go/affine-five-pass -> literal-prefix:01 -> initializer:0x22db7e -> subtract-indexed:bias=11;index=31 -> Reverse -> subtract-indexed:bias=-1;index=13 -> SwapAdjacent -> subtract-indexed:bias=-21;index=7`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x40F200 size 8128 bytes