Overview

overview

10

Static

static

10

1.exe

windows7_x64

10

1.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1.exe.vir
  • Size 176KB
  • Sample220621-lcf2dsehf2
  • SHA256 61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratunizxloader

Malware Config

Extracted

Family

  • xloader

Version

  • 2.8

Campaign

  • uniz

Decoy

  • ZBCuBDslv1vmdg==

  • Tf0bKIL7UwC+XwBS

  • YQAj8CUa+qQn4NVV

  • c2VpeA0CV0kHeeq31nYPNgE=

  • Yhin8SpRfm1NbLm9nOThBw==

  • eyIn8RqE6k/h/YkDntqoMKVA

  • W/mS4B+Zbo6mZ6024Q==

  • 96FIkNOqhgj5rKAYr7S/JxaIrKNEEg==

  • z4QXqB6NZViPQvPsHTgCGh6OaJ9DEAhD/Zw+pQ==

  • z3D/WJZrRZ9wJDa2GIMXEA==

  • sWh+QWdXHJePJ/l5/zU6iQNdX3UE

  • FL1V2Tmuv1vmdg==

  • IeL4/3li2MqV2ubg7g==

  • UPqU6i+W7FlT8Jizi83T

  • xFoDgOwNGwmcN0Q6GIMXEA==

  • M+T00gzvwwvEZnXypOfsKPBJzu70TAs=

  • JuD4/pF5R4qIiFWoGIMXEA==

  • fiy88SOceKo2PHU=

  • Tf+kJJDy0LB5sg7b73YPNgE=

  • 952zrSIBT08QrIzqdJpPQ0Jq8yO1s2OpNg==

Signatures

  • Xloader Payload 1 IoCs
    rat
  • Xloader family
    xloader

File Explorer

  • 1.exe.vir
    .exe 176KB

1.exe.vir

  • SHA256 61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Xloader Payload

    rat
Minor OS version
Major OS version
Entry point
128736
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths