Malicious
Malicious

ecf39e1667dcce2ca7732f9c727d7854

Share on LinkedIn
Print
PE Executable
MD5: ecf39e1667dcce2ca7732f9c727d7854
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
79138e57f432ac8e0a450066e9aa432fe41366ba5a5966512a9c07d56c7b1b4f
MD5
ecf39e1667dcce2ca7732f9c727d7854
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/79138e57f432ac8e0a450066e9aa432fe41366ba5a5966512a9c07d56c7b1b4f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,904 B
First seen
2026-10-28 02:30 · 43 minutes ago
Last seen
2026-10-28 02:30 · 43 minutes ago
Last analysis
2026-10-28 02:31 · 42 minutes ago
Hashes
MD5 ecf39e1667dcce2ca7732f9c727d7854 Sha1 155ea7758fc25122590cf252fa57a104255db9da Sha256 79138e57f432ac8e0a450066e9aa432fe41366ba5a5966512a9c07d56c7b1b4f Sha384 32aa40ac8ff8fbfcf692913047617135cc0d2fdad9d98005299aa5a5bbefdb2e79d0c00bd0daadc76068b76faa2a8968 Sha512 2757df9bf7e059503f91103201582785443eb1bc650f2a49e8f0fc680843bfb70d59bb55ef5220c2d4ac8bcc6752b8b64d8c22439295969d532ec99d91fde537 SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+Z:yBkKr5rszpNDy+Z TLSH 23C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEecf39e1667dcce2ca7732f9c727d7854Go Loader (Factory-v3)
Structure
BINOverlay_084ebf00.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_084ebf00.bin (280 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙