xloader | 1232-63-0x0000000000400000-0x0000000000428000-memory[.]dmp

General

Target

1232-63-0x0000000000400000-0x0000000000428000-memory.dmp
Size

160KB
MD5

c423e59c3ebb73d59d3c1366c021fc31
SHA1

a14cd6a290b423692b2d7adcdc84bcf570969daf
SHA256

96b30a63ae25728e5c1c6a35a771df779c8b17c0fd6180d6ab30104a8a2fd700
SHA512

a7845b962c9e6d2c571f03dc680a72b44a7809985813a5ece86eaf38db114adb1391745e7d536de3347cc4d41b639c5888269f3b2e4f46fac2fa83889119969c
SSDEEP

3072:5ZBq0c6gQ/qI4rQo4j1PHrFf+baIH7VO5dUdYkVo0z8gT4GNefG:5m09Wco4hvhfKrBO5dUdYkVo0RsfG

Score

10^/10

rat mej0 xloader

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mej0

Decoy

mtxs8.com

quickskiplondon.com

sltplanner.com

generatedate.com

amsinspections.com

tomrings.com

109friends.com

freelovereading.com

avalapartners.com

nordiqueluxury.com

inmbex.com

everybankatm.com

bo1899.com

ashymeadow.com

pubgm-chickendinner.com

takudolunch.com

carlagremiao.com

actonetheatre.com

wemhealth.com

khasomat.net

Signatures

Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
sample	xloader

Files

1232-63-0x0000000000400000-0x0000000000428000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 156KB - Virtual size: 156KB

.text
Size: 156KB - Virtual size: 156KB