Overview

overview

10

Static

static

10

malware/EinTT.exe

windows7-x64

10

malware/EinTT.exe

windows10-2004-x64

10

malware/fox.exe

windows7-x64

3

malware/fox.exe

windows10-2004-x64

3

malware/guJPO.exe

windows7-x64

10

malware/guJPO.exe

windows10-2004-x64

10

malware/loader1.exe

windows7-x64

10

malware/loader1.exe

windows10-2004-x64

7

dnjdbaa.exe

windows7-x64

3

dnjdbaa.exe

windows10-2004-x64

3

malware/regasm.exe

windows7-x64

10

malware/regasm.exe

windows10-2004-x64

10

malware/vbc.exe

windows7-x64

10

malware/vbc.exe

windows10-2004-x64

7

rywcikv.exe

windows7-x64

3

rywcikv.exe

windows10-2004-x64

3

malware/vbc1.exe

windows7-x64

10

malware/vbc1.exe

windows10-2004-x64

7

eblupydfzx.exe

windows7-x64

3

eblupydfzx.exe

windows10-2004-x64

3

malware/vbc2.exe

windows7-x64

10

malware/vbc2.exe

windows10-2004-x64

7

ioatgumevw.exe

windows7-x64

3

ioatgumevw.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9404c7a99bcdde02f50e378d1dffad170426af7c1c5c545b2f6fd57de48ffad5

  • Size

    1.8MB

  • MD5

    8fae35da9fc7bd3729bc7a3e361bddda

  • SHA1

    1198db2a80225df6aa0bde198c10673695f5b2c5

  • SHA256

    9404c7a99bcdde02f50e378d1dffad170426af7c1c5c545b2f6fd57de48ffad5

  • SHA512

    9c55baf896cab02a0e604aa1e23e1afac8b0700b3d6cfd6a72528b13e81f76088416521f37e05cbbebd9bb716a928747ae3b3053655f4baa68ee697fd36d8927

  • SSDEEP

    49152:xfW7yuwnU3kTKsa0SHJlOcDXC0Ury02BmpsDHY0o7v5k:geuaN8ny8C/yepsbUu

Score
10/10
ratahc8xloader

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

  • Xloader family
    xloader
  • Xloader payload 1 IoCs
    rat
  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

Files

  • 9404c7a99bcdde02f50e378d1dffad170426af7c1c5c545b2f6fd57de48ffad5
    .zip
  • malware/EinTT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • malware/fox.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • malware/guJPO.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • malware/loader1.exe
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • dnjdbaa.exe
    .exe windows:6 windows x86 arch:x86

    96ab1c5cd8061048905e90e13e54f788


    Headers

    Imports

    Sections

  • ifurxc
  • u7f7s62srqfy
  • malware/regasm.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • malware/vbc.exe
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • hcwh42mnqly0g
  • rywcikv.exe
    .exe windows:6 windows x86 arch:x86

    190c6a3947676ff3239bab46bb6e508a


    Headers

    Imports

    Sections

  • tmogtpc
  • malware/vbc1.exe
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • eblupydfzx.exe
    .exe windows:6 windows x86 arch:x86

    190c6a3947676ff3239bab46bb6e508a


    Headers

    Imports

    Sections

  • k3wc0faknhbe
  • xxxknyg
  • malware/vbc2.exe
    .exe windows:4 windows x86 arch:x86

    56a78d55f3f7af51443e58e0ce2fb5f6


    Headers

    Imports

    Sections

  • 7yk8h1szdi
  • ioatgumevw.exe
    .exe windows:6 windows x86 arch:x86

    190c6a3947676ff3239bab46bb6e508a


    Headers

    Imports

    Sections

  • kghzkpgyin