Malicious
Malicious

f24490c6ec2c260472881735798302a7

Share on LinkedIn
Print
PE Executable
MD5: f24490c6ec2c260472881735798302a7
Size: 8.75 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 8.3 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
54e791eba46a6655cdc58b8dc7813d27d5fcf94a1bc10468e0334f6cb7f3d32f
MD5
f24490c6ec2c260472881735798302a7
Verdict
Malicious
File type
PE Executable · 8.3 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/54e791eba46a6655cdc58b8dc7813d27d5fcf94a1bc10468e0334f6cb7f3d32f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
8.75 MB · 8,753,016 B
First seen
2026-11-02 00:45 · 9 hours ago
Last seen
2026-11-02 00:45 · 9 hours ago
Last analysis
2026-11-02 00:45 · 9 hours ago
Hashes
MD5 f24490c6ec2c260472881735798302a7 Sha1 2750a97eaacce553e368246590ce0122acc30924 Sha256 54e791eba46a6655cdc58b8dc7813d27d5fcf94a1bc10468e0334f6cb7f3d32f Sha384 fe5830a3c39380c1d202896ab95ce341849832d385820813e4f42e50393c48e2b44405e9942ab88fe747d1e31bb5c0a0 Sha512 051b6307bba5982ec0f793c7a76dbc558ee0823f447020d90aa695128b6f5f4583f3b36737942da7d45f16c6d47c395693446e020d5a250d5b9268b0a5e5e6b3 SSDeep 49152:N6JtiF3Q6RydlzsFK/jOmHClE9EnXdK8uB1vU+g8fMyzzKD+0C+2ev5Cz3xRFtY8:NRybij8TPQgt4gTPaspkw TLSH 35964B036BA940B8D499EA38C57E4251BB25BC4CC73433DB7F616AB42F517D1ABB8780
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEf24490c6ec2c260472881735798302a7Go Loader (Factory-v3)
Structure
P7B[Authenticode]_fb806398.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x857000 size 8056 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙