Go Loader (Factory-v3) malware analysis – fa3e9bf80185

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

6.33 MB · 6,328,320 B

First seen

2026-10-06 03:15 · 19 days ago

Last seen

2026-10-06 03:15 · 19 days ago

Last analysis

2026-10-23 19:29 · 2 days ago

Hashes

MD5 f2d88aa41c35d7b0af0c79b8ef09192f Sha1 dd05335ee340229742d27722057774380ada19c8 Sha256 fa3e9bf80185c5524b3669d856f619ff94538fb71b3c56a636cc0d819e3e81a1 Sha384 b5cdf575a78aef114c05ac54acd9064327e97cf479c74e14889248bcdbcb13d519b7fcb99aaec953479a33dab8562c51 Sha512 38d2aeb5823f451ab4e6499551031403acc5e0c66391692b4d74817d6136a7f310a16d2c9c7c41e0b8c5d756f5e42ac8f1e14a27cd92be388168fe0c9acd3d05 SSDeep 49152:FFklDT/uQkck/7Tgr5jAt5mzP68YR66qUMre+iM5FOZ30TMqcuzOBexKcK9KJEIR:FCYeAizybJqxL5Fk0TMv4OCEf TLSH FF565A07F9A31CA9E099A33188A79252BBB17C495B3223D72F90F7782F727C06975714

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12Private EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 4 files

EXEf2d88aa41c35d7b0af0c79b8ef09192fGo Loader (Factory-v3)

Structure

EXE[GoLoader payload 1].exe

Structure

BINOverlay_24190d83.bin

P7B[Authenticode]_28e4cc8a.p7b

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
GoLoader	`GoLoader payload 1: 704653 bytes, sha256 4bdbe826bd38fedca2597ff3ebcb9e532d9b9210dea195f115add425258a6904, Factory-v3/five-pass-indexed -> seed:0x10984 -> literal-prefix:3242511248c37e80a2ae9ec2d6 -> initializer:0x1d5b22 -> trim-end:0`
Info	Authenticode present at 0x5AEA00 size 2432 bytes

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

GoLoader

GoLoader payload 1: 704653 bytes, sha256 4bdbe826bd38fedca2597ff3ebcb9e532d9b9210dea195f115add425258a6904, Factory-v3/five-pass-indexed -> seed:0x10984 -> literal-prefix:3242511248c37e80a2ae9ec2d6 -> initializer:0x1d5b22 -> trim-end:0

Info

Authenticode present at 0x5AEA00 size 2432 bytes