Overview

overview

10

Static

static

10

336-75-0x0...ry.exe

windows7_x64

1

336-75-0x0...ry.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    336-75-0x0000000000400000-0x000000000042C000-memory.dmp
  • Size 176KB
  • Sample220629-j29znahff3
  • SHA256 23bccc8a9a31bc34baa61473a73963f9c006279dbca8c83459688beb96ad4e2d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ratmpbzxloader

Malware Config

Extracted

Family

  • xloader

Version

  • 2.8

Campaign

  • mpbz

Decoy

  • AFdStYOhMDze00V1hnjGCf/fp1v4+A==

  • ZnfAIsHgcxk9kM4Sz7YEifybsGEs

  • MSKYDNgVeOmIguKRNo3Z4PyUbi0=

  • NMPAGs7rYQIBpeAr

  • EfevdW+hVAcBpeAr

  • Wznp4vEGIOuJFA4a4gxfrw==

  • 6mtbGypV7YGH6zPDuS0nngWbsGEs

  • 7cWVjIuvkhymbTWNPzUb+Pe4hjsDuGboGT7sNg==

  • L6voycXlAMZ8MMzl6w==

  • rgMur1GCfl7Exa4=

  • eocEYQEsq7JBy7KSQ6PEB3tk

  • 6mqjioi05oIbr7UZ8FaqUcWKUFQO2P4=

  • 8vl/8cwBIu5yxkrTwRr9cN+3JA==

  • Y3biTBVKik/HsAstQiL0EMGgMA==

  • GxKSTFqREswCckxq40gl

  • vbck7fUZlLFQ1tuBFxqDEMGgMA==

  • e9vCiqC4UgYBpeAr

  • xjNyRCJ/1l7fv7k=

  • RQzRt6vm+hJCoss5GobK1/yUbi0=

  • ypxWQkxxdF7Exa4=

Signatures

  • Xloader Payload 1 IoCs
    rat
  • Xloader family
    xloader

File Explorer

  • 336-75-0x0000000000400000-0x000000000042C000-memory.dmp
    .exe 176KB

336-75-0x0000000000400000-0x000000000042C000-memory.dmp

  • SHA256 23bccc8a9a31bc34baa61473a73963f9c006279dbca8c83459688beb96ad4e2d
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Xloader Payload

    rat
Minor OS version
Major OS version
Entry point
128816
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths