Malicious
Malicious

e6ef63dd0e6c18c8533649aefe84d999

Share on LinkedIn
Print
PE Executable
MD5: e6ef63dd0e6c18c8533649aefe84d999
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
e98a383f2ac8c34b44c2fdf33790b3fec6123320c5dd38004cd29ca657d8e4bd
MD5
e6ef63dd0e6c18c8533649aefe84d999
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/e98a383f2ac8c34b44c2fdf33790b3fec6123320c5dd38004cd29ca657d8e4bd

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,624 B
First seen
2026-10-28 03:30 · 15 minutes ago
Last seen
2026-10-28 03:30 · 15 minutes ago
Last analysis
2026-10-28 03:31 · 15 minutes ago
Hashes
MD5 e6ef63dd0e6c18c8533649aefe84d999 Sha1 a71224508c275ed2cd04f921bcbe9ecb7b0f208a Sha256 e98a383f2ac8c34b44c2fdf33790b3fec6123320c5dd38004cd29ca657d8e4bd Sha384 09587d27aa4ee0faf24840ecf7cb036259f91f1b1111d1cf0454bf83c7ae53ae9572cc3cecc9c683e22413156950d2e5 Sha512 73f43b64b7353e3334d5d219d54faae9ea3bdd0109e89e251fd32a75c70ca7d13b655b719f10a9e019b5235e3c4b1950896f909e32518cd55f786544ed30b34e SSDeep 49152:KpXZKft05HtyvruRo9JBDRHCTdU391KX1NbNV4L6d+NTPeGFPbQuhHEPCw8sWAyB:CZ0tkRorxxCO3ukFJFzAKoU4aeEl TLSH E2C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEe6ef63dd0e6c18c8533649aefe84d999Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙