xloader | 3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9

Resubmissions

21/11/2024, 23:42

241121-3qavzazmfy10

21/11/2024, 23:41

241121-3px9wazmfw10

21/11/2024, 22:36

241121-2jed5symct10

21/11/2024, 22:32

241121-2gbkgatjan10

Sharing

Copy URL Twitter E-mail

General

Target
3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9
Size 164KB
Sample241121-2jed5symct
SHA256 3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9
MD5 0d5e53796965854c4d0f3b9f7408f4dc
SHA1 62de4000e914975a41837829c6c1b8be2883f33e
SHA512 6ec4e852e9d4d24cc54ce11be16023ac012e18fe100922c8a904ae27af565c633a3318878e7044013ab5778a692d6480f9da63283859402a720e467b95484297
SSDEEP 3072:n4ppbC2Q2yvfzWbdMKa5z/gfvtT4bxKKEdbtk5y0itDI:nix7hMKcLGtT4bwkM0it
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat rhen xloader

Malware Config

Extracted

Family

xloader

Version

Campaign

rhen

Decoy

transparenciacirurgica.xyz
martinyaleafrica.com
tshop-dz.store
carte-grise-vehicule.net
diazblanco.xyz
sellwithjaycombs.com
chickytattwo.com
pettyuniversity.net
northstarbets.com
robertatoschi.com
ignumhnk.quest
hydrakitten.com
hyperpinealism.info
deadwoodsportsbets.com
workhardriseabove.com
thestogiestore.com
subconsciousgod.com
furiousdubai.com
chauffeureddriven.com
cabinetfuid.com
xn--w7uy63f0ne2sj.com
facchianomech.com
anamnetic.net
malyde.com
xn--ekrt15fxyb2t2c.xn--czru2d
dm107.com
owfepurb.cloud
fandepay.com
medicalcircle.net
atlantapressurewashingco.com
modellerstyle.com
encorrcolorado.com
josephstafford.net
lexahome.space
baltimorepaintingexperts.com
7075aluminyum.com
luloshirt.store
bestofphilippines.net
golfenhockey.online
wingsboxmalta.com
cesiesis.com
rufus-global.com
svatbi-biju.com
vimeoindo.com
smokyglass.store
investingcapitalgrowth.com
mandalamedicinals.com
martinmarkfly.online
wealthosity.com
kisoch.store
zahidrasool.com
lorodicahtoyof4.xyz
gofinanzz.com
edificationhub.com
048skz.xyz
ebresports.com
newbootsonline.com
mascommsys.com
heelbasicgradually.xyz
piaohua33.com
infocardmarketing.com
nokushop.com
reitsway.com
rabazamba.com
jornadadaeducacao.com

Signatures

Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
sample	xloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9

File Explorer

3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9

.exe 164KB

3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9

SHA256 3edab742079945e0c1f82cb389c48406bb46188fdc0fd53c24526cc802ddc1b9
MD5 0d5e53796965854c4d0f3b9f7408f4dc
SHA1 62de4000e914975a41837829c6c1b8be2883f33e
SHA512 6ec4e852e9d4d24cc54ce11be16023ac012e18fe100922c8a904ae27af565c633a3318878e7044013ab5778a692d6480f9da63283859402a720e467b95484297
SSDEEP 3072:n4ppbC2Q2yvfzWbdMKa5z/gfvtT4bxKKEdbtk5y0itDI:nix7hMKcLGtT4bwkM0it
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Xloader payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths