Malicious
Malicious

e99ccef4a88950422cc500e1af8c9e64

Share on LinkedIn
Print
PE Executable
MD5: e99ccef4a88950422cc500e1af8c9e64
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c31031efad2d7fe4d436a5a8b962f5dd1b64f3026e96b5ebe2dd184987a8d83f
MD5
e99ccef4a88950422cc500e1af8c9e64
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/c31031efad2d7fe4d436a5a8b962f5dd1b64f3026e96b5ebe2dd184987a8d83f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,570,112 B
First seen
2026-10-29 01:01 · an hour ago
Last seen
2026-10-29 01:01 · an hour ago
Last analysis
2026-10-29 01:01 · an hour ago
Hashes
MD5 e99ccef4a88950422cc500e1af8c9e64 Sha1 9d9b04cb0467dfd2a1e40c8cfad5cc55a291e8d3 Sha256 c31031efad2d7fe4d436a5a8b962f5dd1b64f3026e96b5ebe2dd184987a8d83f Sha384 dd43292dc87d312aa4505f619c95647dabe08f93494d052c335440803f1d3d4daa114d0dfb64c633345e6f2ad2f2dc63 Sha512 7e67477cac24bd2319714b3d1a63f57a7386e2ce196ef0ec38573f6ad24dcf14d5a265ae4c5fd8bc267480f5c50f08a487bab5e876a8580fab6cde146d2947a1 SSDeep 49152:SBiYLtcEUP6VAs2Sf9JRToDCMChlxFlxqyr/6vgJsdbkkVew3mp03eZROdwvfZOG:DYRcNSfrd4CXlTRMzSXvkT4CrEvO/ TLSH 29C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305

1 malicious · 1 file
EXEe99ccef4a88950422cc500e1af8c9e64Go Loader (Factory-v3)
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙