xloader | 4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63

Sharing

Copy URL Twitter E-mail

General

Target
4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63
Size 164KB
Sample240306-2lta3sbb79
SHA256 4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63
MD5 81deb46bb491ac34c3e66756d2b18848
SHA1 8f9b35b29a6887e91f29d58dc3dd31c94cc1a006
SHA512 0adbfd2c998d2a47a0c7021d2f8baf3f5f84e43b1c7b53e1dc6d9258aac08078fc00ab60221f341f5dadbf1424c0c0c72cb537557d30f31e8e5a48c64256245b
SSDEEP 3072:LBi7vyKGyDTFIuoE+923NT5CKzROWtX77Vrm+Edsdy1Ik:krdjoEiip5CgOWtX778xKdCI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat cna8 xloader

Malware Config

Extracted

Family

xloader

Version

Campaign

cna8

Decoy

exceptionalhospital.com
agshorizon.com
sabaisurfing.com
kathrynprosser.com
news-roma.com
lareinadelosalisados.com
iregretnotcomingupwithit.com
dreamwrldrp.com
brickhallschool-ng.com
exgobal.com
ojcllc.com
pineviewsunrise.com
ru-joking.com
theparkplasticsurgery.com
mouthsecond.today
princessmasksandapparel.com
onlinedavetiyecim.com
animegirls.xyz
heicat.club
brazillianallstars.com
evlvacations.com
loveworldjerusalem.com
u9wm4u5fssmaj.net
diamondmobiledetailingmo.com
christlicheliebe.net
bemeximus.com
resellerpagecomputers.com
bexbakingcompany.com
trytagawy.com
consentidomusic.com
hauntedthing.com
taoranzz.com
saiparahnama.com
eiz.one
advokatpengacara.com
rapidocoin.net
okbabe.site
cursoexitus.com
zbjingrui.com
diy-and-home-improvementt.com
triaggdesign.com
theplushtoothbrush.com
cowbex.info
outhomenow.com
dietas-medicas.com
czpeixun.com
interlingue.info
18tshortstore.com
jubilee21.com
5725carnarvon.com
sussexnutritionist.com
flyonit.network
ouhaiwutian.com
thebombshellcomics.com
loc7v7.com
san-andreas.online
oilyusa.com
starsandspices.com
goldenpictureszambia.com
cozdat.site
hyderabadmanhattancondos.com
svsnovotec.com
larray.com
wesharefiles.com
oeayzom.com

Signatures

Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
sample	xloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63

File Explorer

4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63

.exe 164KB

4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63

SHA256 4c08e19cc5df70fe44f68663be0b45a421537e28c4e23aec7b42b0a386291c63
MD5 81deb46bb491ac34c3e66756d2b18848
SHA1 8f9b35b29a6887e91f29d58dc3dd31c94cc1a006
SHA512 0adbfd2c998d2a47a0c7021d2f8baf3f5f84e43b1c7b53e1dc6d9258aac08078fc00ab60221f341f5dadbf1424c0c0c72cb537557d30f31e8e5a48c64256245b
SSDEEP 3072:LBi7vyKGyDTFIuoE+923NT5CKzROWtX77Vrm+Edsdy1Ik:krdjoEiip5CgOWtX778xKdCI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Xloader payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths