Overview

overview

10

Static

static

10

ecaf982244...6a.exe

windows7-x64

ecaf982244...6a.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecaf982244b42972b65eece74e724d11d30a69fe8e14aa1f211b0f531464f16a

  • Size

    300KB

  • MD5

    eb75f5da7e71e46d6300413ca4b4d79c

  • SHA1

    6b5fc86d61dda79e6095e893a2b8d38303bc3594

  • SHA256

    ecaf982244b42972b65eece74e724d11d30a69fe8e14aa1f211b0f531464f16a

  • SHA512

    97187a62cb88c5f1112fc0d20e245fd6831fa8d45626848e85d7b5feaeec738e0af3a65c25719cd33b1b214641cb5e7ff27711bfd4d0fd15ebf17ae5a5aa085b

  • SSDEEP

    6144:0ZCj7eYxhJXmMcV7F+dTJuYgSAVRPakvP4buxg/SfQWV:v7DyTV7FmXgrakvQyx8SfJ

Score
10/10
ratihg0xloader

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ihg0

Decoy

mdmonoclonals.com

bologna-wine.com

threensales.com

slottomb.com

precisionmedicalbillings.com

sailorswife.online

agentguidebook.com

varharmvin.report

0eh.biz

osotactical.com

hpdsde.com

waryavier.online

raniisa.com

dreamemarat.com

superiorazmade.com

kinetoscopia.net

koomall66.com

klayraccoonman.com

pascal-rocha.com

initialepharma.com

Signatures

  • Xloader family
    xloader
  • Xloader payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ecaf982244b42972b65eece74e724d11d30a69fe8e14aa1f211b0f531464f16a
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections