Overview

overview

10

Static

static

10

pay2.exe

windows7_x64

10

pay2.exe

windows10-2004_x64

10

Resubmissions

21/06/2022, 09:20

220621-lazeyscffm10

20/06/2022, 13:28

220620-qqrghaffh7

Sharing

Copy URL Twitter E-mail

General

  • Target
    pay2.bin
  • Size 174KB
  • Sample220621-lazeyscffm
  • SHA256 c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratutg6xloader

Malware Config

Extracted

Family

  • xloader

Version

  • 2.8

Campaign

  • utg6

Decoy

  • HH9H3kXZHIk0wrXfJq4s5Q==

  • dJojMwcUlkY3/12Ghl4=

  • M97sg6hotTOvNY1D

  • 6o+YPIQARtqPHA4sKdmWYke8FA==

  • Pt71lrWLDblvQJ9A

  • K0fU6/BseTox+kSSmYQw5NtN00EV7tXr

  • 4sohLE0CeRrTl+2X03jpYke8FA==

  • zrcKky6asFs+yUeWmQ==

  • VodJdmzh+A==

  • gobc7RDsOEAw9A==

  • xEYVn8uhKPPkPWuJo43QVuWhzgLM

  • Fw9Ybr9DXRz9jnd/jXvyYke8FA==

  • VCyIpJ9WjQS9AUudt5mWvMjCzE4=

  • 0a6vT2kQTs1+SYepk6NO

  • TGCqvhzKUAj3RWvPX/5G

  • h4bU7i39XUJV4szsQt9e/A==

  • vwqYIIH/DLW3bpeqo3HpYke8FA==

  • vxbocZI8hKNcZb9Moli2Yv0dHg==

  • 7JCQHUYhm19m7lrqPADuDrOhzgLM

  • gJjwBFXqM6BPYIxcaVY=

Signatures

  • Xloader Payload 1 IoCs
    rat
  • Xloader family
    xloader

File Explorer

  • pay2.bin
    .exe 174KB

pay2.bin

  • SHA256 c4692b54a5619346cd90557fc71a3bcb9a5712d40b5e30411a87f4bec4697005
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Xloader Payload

    rat
Minor OS version
Major OS version
Entry point
128688
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths