Sign up free
Malicious
Malicious

fe139557fa7091530611f32d89e0fbe0

Share on LinkedIn
Print
PE Executable
MD5: fe139557fa7091530611f32d89e0fbe0
Size: 5.88 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 5.6 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4d224ec1f1b1122655a24b10acc9862e8e735d95115637014f1b302390be0a33
MD5
fe139557fa7091530611f32d89e0fbe0
Verdict
Malicious
File type
PE Executable · 5.6 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/4d224ec1f1b1122655a24b10acc9862e8e735d95115637014f1b302390be0a33

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
5.88 MB · 5,884,832 B
First seen
2026-11-03 23:45 · 6 hours ago
Last seen
2026-11-03 23:45 · 6 hours ago
Last analysis
2026-11-03 23:45 · 6 hours ago
Hashes
MD5 fe139557fa7091530611f32d89e0fbe0 Sha1 889e80012ad0bbf0cf645e2088aae64609f91212 Sha256 4d224ec1f1b1122655a24b10acc9862e8e735d95115637014f1b302390be0a33 Sha384 d8640f4e97b4c141b97e7d395fc015e01f9e313133e073c7e6fe1ce0e16f6b1218971bc65a23ee377c61bc03aa3227b4 Sha512 37206e434427712a08a0b6a947db35e436215fd88cc092c77809715c8b0d05dd2b8358e974689fe6e0cb903fbaec2f81f46724c623767df77525870118065049 SSDeep 49152:gAbwpwMCMYEuJ2dGpnQDlQZvZ98V12yc2yKFUVmdYuP5cvblxLcq:gXFlwnUbnFymdP2P TLSH DB565B17BDD699AAC4AAE630C86A51027AA4FC4C6B3133E31F90BF341E727D05D78B45
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEfe139557fa7091530611f32d89e0fbe0Go Loader (Factory-v3)
Structure
P7B[Authenticode]_7dd9cc4b.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x59AC00 size 8096 bytes
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙