Malicious
Malicious

eea5ab951380325739c3cf50e8aa4431

Share on LinkedIn
Print
PE Executable
MD5: eea5ab951380325739c3cf50e8aa4431
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9c1b195ecc5d234296c315fb5ff6d512a43fdbb54be956111f337add02374798
MD5
eea5ab951380325739c3cf50e8aa4431
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/9c1b195ecc5d234296c315fb5ff6d512a43fdbb54be956111f337add02374798

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
12.57 MB · 12,570,112 B
First seen
2026-10-28 10:45 · 2 hours ago
Last seen
2026-10-28 10:45 · 2 hours ago
Last analysis
2026-10-28 10:46 · 2 hours ago
Hashes
MD5 eea5ab951380325739c3cf50e8aa4431 Sha1 be6856b2820020203ab4425cafe9d07c4291f94f Sha256 9c1b195ecc5d234296c315fb5ff6d512a43fdbb54be956111f337add02374798 Sha384 9f04e704c825a962233e931d08dfacad82b1c65904f23ccd102ee7c250321fba2787ed6b56702b173cba6a6da9c2bf72 Sha512 ae36b6a03fa83765013e2ca3683e0de2d7fc70bbad94c925d0607753fbb53bdb8ef1f0db1e91c057d893c28b5fe74e7a20458cb75347ce6a2dffd4a55829bee0 SSDeep 98304:2GsqTIVri2C3jGdD4/Lo2r4i3HVd7EqO/:bTx3jUDsjrTeqO/ TLSH 42C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEeea5ab951380325739c3cf50e8aa4431Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙