Malicious
Malicious

eaa0d45b1fe07c8d1523455daebb1390

Share on LinkedIn
Print
PE Executable
MD5: eaa0d45b1fe07c8d1523455daebb1390
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
746a5beb10b790eb534f206f8d851c34e6816e1e469437185605dcc22f804650
MD5
eaa0d45b1fe07c8d1523455daebb1390
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/746a5beb10b790eb534f206f8d851c34e6816e1e469437185605dcc22f804650

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,571,136 B
First seen
2026-10-25 07:45 · yesterday
Last seen
2026-10-25 07:45 · yesterday
Last analysis
2026-10-25 07:45 · yesterday
Hashes
MD5 eaa0d45b1fe07c8d1523455daebb1390 Sha1 64e4212920f0e002399343e99ab7ea638d85c16c Sha256 746a5beb10b790eb534f206f8d851c34e6816e1e469437185605dcc22f804650 Sha384 0c0bc88c00158131c09ac51609d8e3b74fc0cfc77a18e069d51904ddd778014b7312d857a9bf5b836dae2c450fed5d4a Sha512 b2e418f2765dd87cae25dab08d00c60be4bcb577946fc2777c67eb48d1caa1e93c729a4fcd36221977e6ea35492ce78e438e815c10b2a3ae26757036163bc2e4 SSDeep 98304:BrU0OJz9uZsSigxE6VCMNmwssDfK4tG20CvE7:AzjsxtVAwsyiHV7 TLSH F3C65B11FACB54F1E903583141ABB27F23315D048B28DBDBEB143B6AF87B6A11D6A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEeaa0d45b1fe07c8d1523455daebb1390Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙