xloader | 13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9

Sharing

Copy URL Twitter E-mail

General

Target
13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9
Size 164KB
Sample241121-zelasaxmav
SHA256 13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9
MD5 3dc4ad3431a254f3ca1c3c8504fae12a
SHA1 2c04efd91e87c007d1746b991a841ff4233f2ecb
SHA512 8019316a521215611c361593dce5b05be649c27f3eaf8becf6eac2177c0c49ebaffd690ac91dacf3a45b2a09586d5af27ca3f5641972a127930ee3b8ce22535c
SSDEEP 3072:e4pp6a2OQFXxYgGlMkzxxAvfdsphNN3AAGoa4iVjCnOYdWz:eCa3OMkNSHdsphNN3IoatVjPYY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat nig8 xloader

Malware Config

Extracted

Family

xloader

Version

Campaign

nig8

Decoy

jmanstore.com
babakrashid.club
hong88888yuanxiang.com
bets-bc-cfeae.xyz
chiragkhemka.com
aignerlabelholde.com
givemelucky.com
mobilethaimassageatl.com
bosskardus.com
postmanmajor.com
lifelineministrieschurch.com
compressathlon.com
dechemuckho.com
vogbuilders.com
azumo.xyz
miskarangsimpang.xyz
birdcagewire.com
cowcatartstudio.com
theinteriorsfurniture.com
lakeforestparkinvestments.com
pro-keto-diet-usa.online
thebestisland.com
judicatio.info
topimagebrands.com
jhkk.info
golden100421.com
goodprice.pro
phantom-medical.com
konekt-top.space
gunnipes.com
neueszene.art
globalcovidsummit.net
fifthbelle.com
hybridsea.com
usflooringz.com
northownmerida.com
encoredma.com
pacobuilder.com
optimizedcoder.com
meesamila.com
superhuemn.com
workdayconvert.com
airelibrerevista.com
hentainftd.com
weroiwmfs.com
cigarette321.com
365personalizedgifts.com
gamestown.pro
dantedivine.com
cookingmachinery.com
corinnequinajon.com
nordgale.com
bigcrypto.xyz
bcreativenet.tech
lvxiaog.com
distressedthenblessed.com
shambomedia.com
vendeconwhatsapp.com
pojokdurasi.com
bullseyefunrun.com
burienapartment.com
polebear.website
yadinshan.com
emilio-m.com
mg-eltekniq.com

Signatures

Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
sample	xloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9

File Explorer

13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9

.exe 164KB

13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9

SHA256 13df52643a87c289ee7a052952412b0b1f0f978289a44d564be1d5b2a87827c9
MD5 3dc4ad3431a254f3ca1c3c8504fae12a
SHA1 2c04efd91e87c007d1746b991a841ff4233f2ecb
SHA512 8019316a521215611c361593dce5b05be649c27f3eaf8becf6eac2177c0c49ebaffd690ac91dacf3a45b2a09586d5af27ca3f5641972a127930ee3b8ce22535c
SSDEEP 3072:e4pp6a2OQFXxYgGlMkzxxAvfdsphNN3AAGoa4iVjCnOYdWz:eCa3OMkNSHdsphNN3IoatVjPYY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Xloader payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths