Malicious
Malicious

f0e99bf985b4dbf4734603c6b8505fc5

Share on LinkedIn
Print
PE Executable
MD5: f0e99bf985b4dbf4734603c6b8505fc5
Size: 6.66 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 6.3 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24
MD5
f0e99bf985b4dbf4734603c6b8505fc5
Verdict
Malicious
File type
PE Executable · 6.3 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
6.66 MB · 6,655,488 B
First seen
2026-10-30 16:00 · an hour ago
Last seen
2026-10-30 16:00 · an hour ago
Last analysis
2026-10-30 16:00 · an hour ago
Hashes
MD5 f0e99bf985b4dbf4734603c6b8505fc5 Sha1 12de2cb4b27f415ca69cad1dd4849ca59e92e878 Sha256 d0abbd4e13d026cea0f62d250080f721a37c3a033afb6b5ec368b31e07243f24 Sha384 4341abf4652080af514567f51859dcea1f43bb4b06254ce650a003c27038b616bc0f530893090c8a063e78bdd683299a Sha512 b50a2c35750a65ec28961e946212e00664d8d3f7bb9197e914c72794df3bdd02da1943d7e90f2cbfe4d5deead4020c90744301c81fc3470a0bb4acd0cecf8021 SSDeep 49152:JILh3xUTBy6rtWgBRM2OuIbIYIBA/GlE3izayT6p8McMjx5EVoQssVeMc+h4iUBt:fB36//MA/G7MEy81c+05Oi TLSH 7E665B07FCA545E9C0AED635CA629263BA717C484B3063D76B50F7382F76BD0AA79700

1 malicious · 1 file
EXEf0e99bf985b4dbf4734603c6b8505fc5Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙