Deep Malware Analysis of f4f8cf99381df6cdcac88b672a8c480c | md5: f4f8cf99381df6cdcac88b672a8c480c | Executable | PE (Portable Executable) | Go Loader (Factory-v3) | Stealer Loader | T1027 | T1055 | PE File Layout | Win 64 Exe | x64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	f4f8cf99381df6cdcac88b672a8c480c
Sha1	476ab14a9e26faa17c441deaa18a616b91ed69bb
Sha256	20b50792cf0acda820f3b2a05ea738d9608c64950f7d3d30191f6c0d5bb25606
Sha384	df95253898dcd43015ec8357fb1c3da30dc7b9da247124c017b9834e27d0614969e298262053805c4ed1b2dbe5d8ffc5
Sha512	d2e38947d3dce29e9f82e70c60cf86aefd4270692d876d23d21e339c960de56f00fd7ba37e47891239ce5ba42c184612974828de128f9ec435d6babc09ae5c20
SSDeep	49152:1QkP+2UUA/9Y3js1/ZG5SkScAAEzjtDf2CqBnnaudGjM9s/xH:1Q3adYLwSBDYdrExH
TLSH	4F069D06BC908CAAC4EAB33189BA52917B7CBC150B3617DB1E60BA752F367D19D37710

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLZProtect v1.4.6 -> * Sign by phpbb3

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:dll~T1027~T1055>bin

Shape pe:dll>bin

malicious 2 nodes

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x37DC00 size 2424 bytes