Malicious
PE Executable
MD5: f6d5c0849652d0c96b1b6232be3ea21f
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 74e338a30646a3894b49b4e4deb27cf2ee537edc899d40e67c65ec996e28928c
- MD5
- f6d5c0849652d0c96b1b6232be3ea21f
- Verdict
- Malicious
- File type
- PE Executable · 12 MB
- Family
- Go Loader (Factory-v3)
- Category
- Stealer Loader
Cite this report: https://app.malva.re/sha256/74e338a30646a3894b49b4e4deb27cf2ee537edc899d40e67c65ec996e28928c
Related Go Loader (Factory-v3) samples
- ea3b82d9a70295c74edd17b90c549a84ca05a31f07c9a398b0c945493fb0dc5c 2026-10-31
- 84f2479430b7a4a4a1fc2d8effaf8e05ade564f792027f6a8ee517e5f3ca3286 2026-10-31
- 661df4b8ef9cb69f714f7fa8105449aeef3d29dbe9cb3d07208f444cead97d0b 2026-10-31
- 5515a2ce2c2622302888667bad60ae1820d0c8790ab96b851d5fd1544304b63a 2026-10-31
- 6605a659f7fe32f673fac7b33cc570e88779f82045f3708d194b2f00f4c178cb 2026-10-30
- 359a7c8a50391ee13a1651b67b118fe7ab6ef6ddeae39876a393857fbfdc692b 2026-10-30
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
12.57 MB · 12,570,866 B
First seen
2026-10-26 01:32 · 5 days ago
Last seen
2026-10-26 01:32 · 5 days ago
Last analysis
2026-10-26 01:33 · 5 days ago
Hashes
MD5
f6d5c0849652d0c96b1b6232be3ea21f
Sha1
0a2bfaa774df4e4c3e1c880925054dc3ae803132
Sha256
74e338a30646a3894b49b4e4deb27cf2ee537edc899d40e67c65ec996e28928c
Sha384
82878f7f3dddff312a06f4e71d7c6f8b40db863383ff8ad480f26d2b813d1b10b39578f45f6e8b3d80060b3e42524580
Sha512
86541543175ad96744144d1534f8f158c2f5ec56d1099262c6fb92cbf9ad49133910dcd3d0b14727b77590befe1999f5caa07867a9e4c19721aabacb0faf289e
SSDeep
98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+B:yBkKr5rszpNDy+B
TLSH
48C65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 malicious · 2 files
EXEf6d5c0849652d0c96b1b6232be3ea21fT1027 · T1055Go Loader (Factory-v3)
Structure
BINOverlay_d59c1922.bin
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1027~T1055>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Attribution | |
| Info | Overlay extracted: Overlay_d59c1922.bin (242 bytes) |