xloader | 2868-62-0x0000000000400000-0x0000000000429000-memory[.]dmp

General

Target

2868-62-0x0000000000400000-0x0000000000429000-memory.dmp
Size

164KB
MD5

4fddfa668cc345a8e6237c1ee3b98815
SHA1

eef5a01c907852955221244ab0fac736d56afac7
SHA256

46ab3f46658240f968a75fedfc96ed4d510404df53ae26300f79c0f7c1076163
SHA512

4103d04e49b3c8766a512643ce8195a4f78b9ae031823b993fe9a8f6e6bbd1d765112f40388ae6ed38674a43e381168cd09c0df24b223c870756d130b3953c34
SSDEEP

3072:QspeY2fikqwsoKMDwDNBit6hFEYtLXq4lyQaZ:QRnz27MDkXit6hFEQq4lyQ0

Score

10^/10

rat mjyv xloader

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mjyv

Decoy

wenyuexuan.com

tropicaldepression.info

healthylifefit.com

reemletenleafy.com

jmrrve.com

mabduh.com

esomvw.com

selfcaresereneneness.com

murdabudz.com

meinemail.online

brandqrcodes.com

live-in-pflege.com

nickrecovery.com

ziototoristorante.com

chatcure.com

corlora.com

localagentlab.com

yogo7.net

krveop.com

heianswer.xyz

Signatures

Xloader family
xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

sample xloader

resource	yara_rule
sample	xloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2868-62-0x0000000000400000-0x0000000000429000-memory.dmp

Files

2868-62-0x0000000000400000-0x0000000000429000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 159KB - Virtual size: 158KB

.text
Size: 159KB - Virtual size: 158KB