Malicious
PE Executable
MD5: ec65f557594b2080cd77d68215c3bc5f
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 1fbaa32225f246cd2d610e7f56a7286acbd5e63f224c807af7c8923fde31581f
- MD5
- ec65f557594b2080cd77d68215c3bc5f
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Go Loader (Factory-v3)
- Category
- Stealer Loader
Cite this report: https://app.malva.re/sha256/1fbaa32225f246cd2d610e7f56a7286acbd5e63f224c807af7c8923fde31581f
Related Go Loader (Factory-v3) samples
- 2163047d98d5d694d5491928c17d8459e3db36fc5422c9bbf9fe518b493d21ba 2026-10-28
- 1cb2e01b531a7b5074b9c9be4bdab93e025e112d6dc1b39d49d5d8ce1dffb4f4 2026-10-28
- 4c3350f65c718ef01fa8acda7beeedee8c769e922e395106947c2febdef886bb 2026-10-28
- 85f4f49e3cd164c59e9e5ebcb0a87d952654414ac3381ee622d39e6160bc9d5b 2026-10-28
- 9c1b195ecc5d234296c315fb5ff6d512a43fdbb54be956111f337add02374798 2026-10-28
- 8114bc114c3fba9ac2a80c1d84ba28bf272b164b46f42b6c12a051d6dd4bb05b 2026-10-28
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
12.57 MB · 12,570,840 B
First seen
2026-10-28 12:01 · 56 minutes ago
Last seen
2026-10-28 12:01 · 56 minutes ago
Last analysis
2026-10-28 12:01 · 56 minutes ago
Hashes
MD5
ec65f557594b2080cd77d68215c3bc5f
Sha1
052215c8318ee0cb83173c26f62f94b4083a85ad
Sha256
1fbaa32225f246cd2d610e7f56a7286acbd5e63f224c807af7c8923fde31581f
Sha384
8939e7221e1b5b3d93f38a9e16c990ca89d14a0a901576387a55fa73d917d11f0676fdedae711c8c47f32bff0da37f43
Sha512
a53be3e1b0a51975af647c1690c6cfb65a11fc848ac2db08c3e482b9ee16f2c24b50bd9483adedbb07b3d2651fd6f619aa89e41bf52dbbf69182efffe7f16265
SSDeep
98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+L:yBkKr5rszpNDy+L
TLSH
00C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 2 files
EXEec65f557594b2080cd77d68215c3bc5fT1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_9c6128be.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_9c6128be.bin (216 bytes) |
| Attribution | |