Malicious
Malicious

eef03b5360332abe50f232349e1d8cd1

Share on LinkedIn
Print
PE Executable
MD5: eef03b5360332abe50f232349e1d8cd1
Size: 6.23 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.9 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
5795fe674d0f9759cdfc26217924dcbdcf37f23a78131bce6d92b3398f608d0d
MD5
eef03b5360332abe50f232349e1d8cd1
Verdict
Malicious
File type
PE Executable · 5.9 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/5795fe674d0f9759cdfc26217924dcbdcf37f23a78131bce6d92b3398f608d0d

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
6.23 MB · 6,233,600 B
First seen
2026-10-31 22:45 · an hour ago
Last seen
2026-10-31 22:45 · an hour ago
Last analysis
2026-10-31 22:45 · an hour ago
Hashes
MD5 eef03b5360332abe50f232349e1d8cd1 Sha1 c2669f6b55443a159258da1bc317b9d38f22a045 Sha256 5795fe674d0f9759cdfc26217924dcbdcf37f23a78131bce6d92b3398f608d0d Sha384 c1f671bee02c50c3557dc83a2a61179a2432b6f16313dde7eeae26b5fdcb6975444d5598867a5bc130e835af5755932b Sha512 1f3b114536f80968cca74b7bd09749bd26aef99ef0d5c29aa1502dba750f8218dad9a8baff282b35d400ab78a5577ecfb924aa1ff827b754c788591a258f836e SSDeep 98304:WR1zEEd/ngl/tsYasjca7tsMIvQFz5VnCPl9+pyayHltn:WRphBc/tsYastsHaVnW2yaYn TLSH AD56D007FCA109E6C0AAA23189B395867F71BC491F2563C72EA0B7782F72BE05D74754
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 3 files
EXEeef03b5360332abe50f232349e1d8cd1Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙