Deep Malware Analysis of ee1c03fd6e4baaa90aa55c31c4558517 | md5: ee1c03fd6e4baaa90aa55c31c4558517 | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ee1c03fd6e4baaa90aa55c31c4558517
Sha1	19b6f328906298a6bf341830fcec757e682604ec
Sha256	594a345627177344e4c9276bb406f86e881e6b7f5268828d9badbe583421d590
Sha384	137604bb61ec7847b87103f9b6a004c1f90a575ed04b183e2597ed3d4d4b89f0c5d4d04a1f868ac2cd7291be93610faa
Sha512	fc8e994c49754ed908d867b4e702d5eee93dfd39ce8f92e3ebe0ccdcecbe43e0d2c3a9e91a0d52d87a8545cc4bf9ff728f2d134efcea8833d253fd8fc51861c2
SSDeep	98304:gmK2vYlgCir2hmpZQe7igeOWOph7BZF/f:gDRmjxBr
TLSH	4E369D037DA140E9C4AA9B39C5771742BB35788C9B3273D72E60B6782E76BC15D38B90

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x4EE000 size 8048 bytes