Malicious
Malicious

fea87e5445562be85c318129225cdec2

PE Executable
MD5: fea87e5445562be85c318129225cdec2
Size: 6.61 MB
application/x-dosexec

This sample is a 6.3 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 2 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d0c440f72378bfe693207e2ce49e504828a881d132b20e5ce3b3443e82d9f06f
MD5
fea87e5445562be85c318129225cdec2
Verdict
Malicious
File type
PE Executable · 6.3 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/d0c440f72378bfe693207e2ce49e504828a881d132b20e5ce3b3443e82d9f06f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
6.61 MB · 6,610,312 B
First seen
2026-10-14 10:30 · 11 days ago
Last seen
2026-10-14 10:30 · 11 days ago
Last analysis
2026-10-23 19:24 · 2 days ago
Hashes
MD5 fea87e5445562be85c318129225cdec2 Sha1 bc0c685b53dcf4adb2fc2468f07344a363f0abfe Sha256 d0c440f72378bfe693207e2ce49e504828a881d132b20e5ce3b3443e82d9f06f Sha384 e3a732e6b2ae397636ae5bd8a4df25ef22d0f65c1021d80891cba937f41d3a578226f6a2ff1b7cdb6d7bd37e0779647e Sha512 1205006fbf1104939b42512f0c76f5a97cf6840cf361b4929e3f87c335d0f08e8679a4568dc32afd09edec924abc54488915ff7d8357ad8d9a1027ebf33ac627 SSDeep 24576:6wRErVjhHcURWbwt5ySKe9Wbrl19Dfymuw5LrUOJA:6qErd5cUR4xe9Fw5HjA TLSH C466C85971C410EDCA8FC37609F45DBE23B21DBF1613968A0799BAE02F12BE65F24D48
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 3 files
EXEfea87e5445562be85c318129225cdec2Go Loader (Factory-v3)
Structure
P7B[Authenticode]_9eb9ddc2.p7b
EXE[GoLoader payload 1].exe
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.
Info
Authenticode present at 0x64BE00 size 8072 bytes
GoLoader 
GoLoader payload 1: 1361920 bytes, sha256 ffd19ce2af9ad6ee5470de6af00e9177cfceec204714643bce1ed165963fe689, Go/decimal-splitmix64 -> segments:7980 -> state-le:45e34f7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64

2 malicious · 3 files
EXEfea87e5445562be85c318129225cdec2Go Loader (Factory-v3)
Structure
P7B[Authenticode]_9eb9ddc2.p7b
EXE[GoLoader payload 1].exe
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙