Malicious
Malicious

f401a4fcf6ea4c330f18e1625dad626d

Share on LinkedIn
Print
PE Executable
MD5: f401a4fcf6ea4c330f18e1625dad626d
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
965746db162d04837da30254e20451f985efb1aff56b724baaa770b7f3de76a5
MD5
f401a4fcf6ea4c330f18e1625dad626d
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/965746db162d04837da30254e20451f985efb1aff56b724baaa770b7f3de76a5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,983 B
First seen
2026-10-26 04:04 · an hour ago
Last seen
2026-10-26 04:04 · an hour ago
Last analysis
2026-10-26 04:04 · an hour ago
Hashes
MD5 f401a4fcf6ea4c330f18e1625dad626d Sha1 c20f694d32f72115447ac4cf60d0c18ae5cc0cbe Sha256 965746db162d04837da30254e20451f985efb1aff56b724baaa770b7f3de76a5 Sha384 df53e0f137df7033dc1962f45a9fc7558a727f120459f790fffdfa45d3432e9fc0726b3d96fd99b9d9dfcd7a407af327 Sha512 30ea1befa5ada29e2fc1292cf46630f69fdd91095c04acfc97bc9477898d50b2629f40697d69b0995316e2b37374c7fa73a7eb28aa3dab4b024ee10187a6ae4f SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+H:yBkKr5rszpNDy+H TLSH 46C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705

1 malicious · 2 files
EXEf401a4fcf6ea4c330f18e1625dad626dGo Loader (Factory-v3)
Structure
BINOverlay_c7a18b03.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_c7a18b03.bin (359 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙