Behavioral task
behavioral1
Sample
ExLoader.exe
Resource
win11-20240611-en
General
-
Target
Exloader.zip
-
Size
151KB
-
MD5
c6c3c12c7afcd9860e733e427eb58924
-
SHA1
ee890ec984095e4e3ed3a452fdc0020d6de60bdd
-
SHA256
c802c3f6097984de6f1b01a67931c8f52bc153d1fceab4bb128e26c9898d8172
-
SHA512
a1459905a57ab48fe522d5a71457140835b58759eb7960696a2943a1cd11d7e58bf6497b89d84d5280c6259e2d4ff0d35706694a80ba55bbcb1b196dbd2b850f
-
SSDEEP
3072:0xUbR1nlHdYwthZ/Bxk/2Zxx3Oa5Enr5ccK7zoT4/0eTtBlvdl:3xlHCwthTGoAa6rbgzokl
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1256361610746925099/IbCyQQ4iqnO5SW1hJgJ5T2ABGEW65CJZGgMuAqC3t24mFSry2Cx2mE0ZcNkbOB4nSwnU
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ExLoader.exe
Files
-
Exloader.zip.zip
-
ExLoader.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 186KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Readme.txt