e88ca2f6fd914b264e3a56faf10161da

PE Executable

MD5: e88ca2f6fd914b264e3a56faf10161da

Size: 5.07 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

5.07 MB · 5,069,728 B

First seen

2026-10-21 11:31 · 4 days ago

Last seen

2026-10-21 11:31 · 4 days ago

Last analysis

2026-10-23 19:08 · 2 days ago

Hashes

MD5 e88ca2f6fd914b264e3a56faf10161da Sha1 8209ad97d95f542bcbd073824e4eae6d190a3ab7 Sha256 6f38c0aedf5d1163cca3bf5721acb71cb54bf387a69827c8ccdc59064a19d6ed Sha384 fa579abb188b3d8c9043d76c7570dafc08287b604052037f670c6ffa39686111dbf7fa803296620553259e0022303457 Sha512 1feaead241fd40ec0ce07145ca455b654a2aa4d6d7b301895d9e8f5a8db6fb0e5d6795260036419857d5b754d7fd58e7a7873cc7104ab45e745ed00d14341583 SSDeep 98304:+c9AyymWm/uVdO7f04yQ+VhT9OUnnzuC7ndqYgBmMIqgosAgCeGz:+cyyymWm/uVdO7f0+NIzuWyQ2 TLSH F7366C12BAD180E8C09AE335862662157B78BC8D5B3133D33E54B7342FB5FD46A79B09

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12tElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXEe88ca2f6fd914b264e3a56faf10161daGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_0a508c92.bin

P7B[Authenticode]_122197df.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 1415342 bytes, sha256 6696d70eb98f7e19986526cf8d11aa61aa3e3eddfd6a069fd3c06ff224c90d3f, Go/affine-five-pass -> literal-prefix:688374909bab9edeb7ded10a0b29 -> initializer:0x206ec6 -> subtract-indexed:bias=3;index=31 -> Reverse -> subtract-indexed:bias=57;index=13 -> SwapAdjacent -> subtract-indexed:bias=92;index=7`
Info	Authenticode present at 0x4D3C00 size 8096 bytes

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

GoLoader

GoLoader payload 1: 1415342 bytes, sha256 6696d70eb98f7e19986526cf8d11aa61aa3e3eddfd6a069fd3c06ff224c90d3f, Go/affine-five-pass -> literal-prefix:688374909bab9edeb7ded10a0b29 -> initializer:0x206ec6 -> subtract-indexed:bias=3;index=31 -> Reverse -> subtract-indexed:bias=57;index=13 -> SwapAdjacent -> subtract-indexed:bias=92;index=7

Info

Authenticode present at 0x4D3C00 size 8096 bytes

2 malicious · 4 files

EXEe88ca2f6fd914b264e3a56faf10161daGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_0a508c92.bin

P7B[Authenticode]_122197df.p7b

No malware configuration was found at this point.