Deep Malware Analysis of ee5f5e9971a0b6bf60f49411d43ecdf8 | md5: ee5f5e9971a0b6bf60f49411d43ecdf8 | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

3.32 MB · 3,317,680 B

Hashes

MD5 ee5f5e9971a0b6bf60f49411d43ecdf8 Sha1 22dbca80786e472454fd780bbdb8e682ceef3713 Sha256 744f82adda79c794c3462ded64800cd9a50f47fb9f198c95e0235abe341944f2 Sha384 f1cd9c65c30a782c67ce8f9bcf0f3c087f1924b9d9407d3926031ec161be37679ac042499c6d8b15eb1a759a295222b0 Sha512 6c7d0801b21ed4096611707d01f63a3b5b8a163fe5785ac15640fbe15f4cb12e393f1c135615d21f2f07396444af2e2db2eed13d1a6d460a3360acf9a4e6d9fe SSDeep 24576:Hb8JR+lbxMwi5hZw8Ds7hhdLEM5NYRzoZ9HuQljcCul0HDfyDYqbYGfNBYAyZp:HOR+vM11wv7fdLEGNRPHrlg7CqbhW TLSH 6CE54A13BFA19078D4A6E235C8B74266B6B4BC4C5B3633E31E21BA342F727D09975B14

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXEee5f5e9971a0b6bf60f49411d43ecdf8Go Loader (Factory-v3)

Structure

P7B[Authenticode]_e7a47e0b.p7b

EXE[GoLoader payload 1].exe

Structure

BINOverlay_4211a1f5.bin

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x328000 size 8112 bytes
GoLoader	`GoLoader payload 1: 336567 bytes, sha256 4306d3d9c3c7563784c792d9e99d2afa3c0e338fc109ea233af69c804ab94aa5, Go/affine-five-pass -> literal-prefix:5b57816f70947c -> initializer:0x193568 -> subtract-indexed:bias=14;index=31 -> Reverse -> subtract-indexed:bias=123;index=13 -> SwapAdjacent -> subtract-indexed:bias=47;index=7`