xloader | 1224-76-0x0000000000400000-0x0000000000429000-memory[.]dmp

General

Target

1224-76-0x0000000000400000-0x0000000000429000-memory.dmp
Size

164KB
MD5

9b5b2f591debd15779083d452017cfad
SHA1

1801b4e96bf22800ab41fd57494913f71b433517
SHA256

1f45e9020c5227528fb02a3b2af46e2372694702f4c6df087ecfcbd8b33bb994
SHA512

1c34c7d3755f4d4b2ed810f3cf7467d26568710f117839f8f8d7030de5a34dfff312f61d1a753c87effcc926ca2e53a6f54ca49b1e7b90a85b6081657aac4d1d

Score

10^/10

rat ssac xloader

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ssac

Decoy

beautybybrin.com

oregemo.com

prospectoriq.com

blazermid.com

cloudnineloans.com

myyntisofta.com

filoupoils.com

web-solutiontnpasumo3.xyz

becbares.com

lines-hikkoshi.com

ohayouwww.com

writingdadsobituarywithdad.com

bridalbaes.com

jamshir.com

rangertots.com

dankbrobeans.com

titan111.com

uplearns.info

maxicashprokil.xyz

evc24.com

Signatures

Xloader Payload 1 IoCs
rat

Processes:

resource yara_rule

sample xloader
Xloader family
xloader

resource	yara_rule
sample	xloader

Files

1224-76-0x0000000000400000-0x0000000000429000-memory.dmp
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Code Sign

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 159KB - Virtual size: 158KB

.text
Size: 159KB - Virtual size: 158KB