Go Loader (Factory-v3) malware analysis – d0c440f72378

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

6.61 MB · 6,610,312 B

First seen

2026-10-14 10:30 · 11 days ago

Last seen

2026-10-14 10:30 · 11 days ago

Last analysis

2026-10-23 19:24 · 2 days ago

Hashes

MD5 fea87e5445562be85c318129225cdec2 Sha1 bc0c685b53dcf4adb2fc2468f07344a363f0abfe Sha256 d0c440f72378bfe693207e2ce49e504828a881d132b20e5ce3b3443e82d9f06f Sha384 e3a732e6b2ae397636ae5bd8a4df25ef22d0f65c1021d80891cba937f41d3a578226f6a2ff1b7cdb6d7bd37e0779647e Sha512 1205006fbf1104939b42512f0c76f5a97cf6840cf361b4929e3f87c335d0f08e8679a4568dc32afd09edec924abc54488915ff7d8357ad8d9a1027ebf33ac627 SSDeep 24576:6wRErVjhHcURWbwt5ySKe9Wbrl19Dfymuw5LrUOJA:6qErd5cUR4xe9Fw5HjA TLSH C466C85971C410EDCA8FC37609F45DBE23B21DBF1613968A0799BAE02F12BE65F24D48

Detection

PeID

HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

2 malicious · 3 files

EXEfea87e5445562be85c318129225cdec2Go Loader (Factory-v3)

Structure

P7B[Authenticode]_9eb9ddc2.p7b

EXE[GoLoader payload 1].exe

Structure

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe~T1027~T1055>bin

Shape pe:exe>bin

malicious 2 nodes

Name Value

Attribution

Name	Value
Attribution	`Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.`
Info	Authenticode present at 0x64BE00 size 8072 bytes
GoLoader	`GoLoader payload 1: 1361920 bytes, sha256 ffd19ce2af9ad6ee5470de6af00e9177cfceec204714643bce1ed165963fe689, Go/decimal-splitmix64 -> segments:7980 -> state-le:45e34f7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64`

Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

Info

Authenticode present at 0x64BE00 size 8072 bytes

GoLoader

GoLoader payload 1: 1361920 bytes, sha256 ffd19ce2af9ad6ee5470de6af00e9177cfceec204714643bce1ed165963fe689, Go/decimal-splitmix64 -> segments:7980 -> state-le:45e34f7fb979379e -> proof:static-expressions -> DecimalTripletsSplitMix64