Malicious
Malicious

fa7f4daf13d59f593c14b482d416538a

Share on LinkedIn
Print
PE Executable
MD5: fa7f4daf13d59f593c14b482d416538a
Size: 3.46 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 3.3 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024
MD5
fa7f4daf13d59f593c14b482d416538a
Verdict
Malicious
File type
PE Executable · 3.3 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
3.46 MB · 3,460,472 B
First seen
2026-10-29 22:30 · 5 hours ago
Last seen
2026-10-29 22:30 · 5 hours ago
Last analysis
2026-10-29 22:30 · 5 hours ago
Hashes
MD5 fa7f4daf13d59f593c14b482d416538a Sha1 9f7ddeb64d87b4682fdca71fa35ac6e77d2a4e09 Sha256 c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024 Sha384 29541a4294ffb2725245de01d4ccf1e9a2fce352cd98064533de1525c3bf3b5ddf23e5377a19f9eec261a1f667199c62 Sha512 ef23528f6dfc2132f11cfb236c7a78016f96e410f7dc6a6a27c04e9845772e93a57779ad989b60ecc65aaaf98f258d14230630807db142047011e4baddbbdb02 SSDeep 24576:A7VlAftU1CARNzz+5rjflBE8zNNg2CV3+olWfjGdVPfHsnSGsDh9jTAUdZ5wsbKU:A73AfPALzi5hzs2sOoaj8HGuOs+k TLSH 23F54A077ED145AAC06AD23AA4BB52227735BC0D977133E71E80AB382F76BC05979F14
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEfa7f4daf13d59f593c14b482d416538aGo Loader (Factory-v3)
Structure
P7B[Authenticode]_a3d59d54.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x34AE00 size 8056 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙