Static task
static1
Behavioral task
behavioral1
Sample
SwitchedLoader.exe
Resource
win10-20240214-en
Behavioral task
behavioral2
Sample
SwitchedLoader.exe
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
SwitchedLoader.exe
Resource
debian12-armhf-20240221-en
General
-
Target
SwitchedLoader.exe
-
Size
191KB
-
MD5
eb4a3c8e8c7ab4958a161b6b4cc81771
-
SHA1
f26d10fc884aa3dd7adb7b4a2a72d7f1714b3a17
-
SHA256
46adc524b8c2df2f74153f8aa494091bd30e03e1fef44edf024e900ab2eb8773
-
SHA512
63f39a1fe8658f518486bde48366016f5b6cbb16a4e58e2ddcfe34351ed3dbd4da25159ad9e50d85a09343006ca0c9221030a6691b5dedb5dd3cfb10abe3cfb1
-
SSDEEP
3072:QPpnwEyi9B4dKuMLotY3roqmxrKJ6d5LEH4Fb4Vby43P9x+KTItDqTegNIv:QBnXyin4dKQVKJ6DbkbpPHTI4TegN
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SwitchedLoader.exe
Files
-
SwitchedLoader.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ