xloader | 392287a24e917681eb8e8f7d82da81dc

Sharing

Copy URL Twitter E-mail

General

Target
392287a24e917681eb8e8f7d82da81dc
Size 161KB
Sample231231-rd3vfacgh3
SHA256 e416ee852d5b60f138ff40f82b52a6018fd9923b5daf2197cee01f23bba885c9
MD5 392287a24e917681eb8e8f7d82da81dc
SHA1 6a55e317286d3f811ac202c01ea78d38afa5ec1d
SHA512 f0e0f96c13120e9ad5d808e27f260813dead9c7436ee60be8c5c810ec1f10bbb3752e351b1e55610090de70bac9e3136ca594aacdc7b9274f54f0e0b00b2f980
SSDEEP 3072:UtBj56f64TnDXoMJHTPJysbAIOctvoKgDpMlLJVcPTd+Ape8:kL2zoMtzAsb7OctvovNMdJ2PTd+A/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat h85m xloader

Malware Config

Extracted

Family

xloader

Version

Campaign

h85m

Decoy

billscoins.net
michkenot.com
vezertalalkozo.com
larguetonmec.com
ifybomb.net
flycomputers.com
ableveg.com
mtpublicadjusting.com
merkabahindustries.com
hilalcambalkon.com
seanses.com
camasirmakinesiservisi.net
thebigoworld.com
buscatijones.com
walkingodslight.com
camp-camp.info
fbjelonic.com
mooch-monster.com
numbergen.net
amazonin.xyz
bilthardusa.com
gamecam.cloud
bws-portal.com
softwarearchitectural.com
smilealways.net
avhh17.com
nurse4.com
jornalarepublica.com
doggosoapco.com
hankangcn.com
fragancebuddy.com
roadco.website
tavts.com
managegroupgh.com
twelloapp.net
abrosnm3.com
memorre.com
thehesscollaboration.com
lntmc.com
update-co-jp.space
caterguard.com
advantagefinancialpartners.com
iconness.com
qvbevug.icu
mimisgarden.net
firstnica.com
trofeosbris.com
uggsoutletosterreich.com
anthonytray.com
littlehousecookies.com
flyteboston.com
msmichellerenee.com
noloshomecare.com
wshp.icu
mnirvana.com
service-hamzewshewg.com
gerarsite.com
sunflour-bakehouse.com
bulletproofvests101.com
umcsuzukijember.com
huntingcatalog.com
brickboyusa.com
mipmn.com
wayforwar.com
thakickbackpodcast.com

Signatures

Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
sample	xloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
392287a24e917681eb8e8f7d82da81dc

File Explorer

392287a24e917681eb8e8f7d82da81dc

.exe 161KB

392287a24e917681eb8e8f7d82da81dc

SHA256 e416ee852d5b60f138ff40f82b52a6018fd9923b5daf2197cee01f23bba885c9
MD5 392287a24e917681eb8e8f7d82da81dc
SHA1 6a55e317286d3f811ac202c01ea78d38afa5ec1d
SHA512 f0e0f96c13120e9ad5d808e27f260813dead9c7436ee60be8c5c810ec1f10bbb3752e351b1e55610090de70bac9e3136ca594aacdc7b9274f54f0e0b00b2f980
SSDEEP 3072:UtBj56f64TnDXoMJHTPJysbAIOctvoKgDpMlLJVcPTd+Ape8:kL2zoMtzAsb7OctvovNMdJ2PTd+A/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Xloader payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths