Malicious
Malicious

f3b8a57474a6f9b81703542c512e9912

Share on LinkedIn
Print
PE Executable
MD5: f3b8a57474a6f9b81703542c512e9912
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
eb35ff6265f6adbe244afbbbe17b8e6461c072c7200c7e4037a5c6b0ba2ae7b3
MD5
f3b8a57474a6f9b81703542c512e9912
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/eb35ff6265f6adbe244afbbbe17b8e6461c072c7200c7e4037a5c6b0ba2ae7b3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,572,672 B
First seen
2026-10-26 07:15 · an hour ago
Last seen
2026-10-26 07:15 · an hour ago
Last analysis
2026-10-26 07:15 · an hour ago
Hashes
MD5 f3b8a57474a6f9b81703542c512e9912 Sha1 65ab06cc6e081403598226ea207f44e500ce0851 Sha256 eb35ff6265f6adbe244afbbbe17b8e6461c072c7200c7e4037a5c6b0ba2ae7b3 Sha384 a88b2618afb426cf4f9ec1272222e043f260754574900ad9cb7ae8cec9b9073a09228bd81f1eb38a569f9ab2e890dc9f Sha512 f543332e29437c337f58b5cc63ac1fb132c7bb65b1372754d47a50b059de413ef5a7b950ece15feeab668741ed246d83ebfb2903e200f0344ca44cdf6505ca9b SSDeep 98304:1BMJ2d5JnzCEmuzzoZRM5WLOB4UG2nNxEL:U2RRmawRMAL4D8L TLSH 34C66B11FADB95F1E803183140ABB37F67315D048B28CB9BEB547B6AF87B6A10D66305
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 1 file
EXEf3b8a57474a6f9b81703542c512e9912Go Loader (Factory-v3)
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055
Shape pe:exe
malicious 1 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙