Overview
overview
3Static
static
3ExLoader_I...er.exe
windows10-2004-x64
1ExLoader_I...er.exe
windows11-21h2-x64
1audioplaye...in.dll
windows10-2004-x64
1audioplaye...in.dll
windows11-21h2-x64
1data/app.so
ubuntu-18.04-amd64
1flutter_windows.dll
windows10-2004-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-21h2-x64
1permission...in.dll
windows10-2004-x64
1permission...in.dll
windows11-21h2-x64
1url_launch...in.dll
windows10-2004-x64
1url_launch...in.dll
windows11-21h2-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-21h2-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
ExLoader_Installer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ExLoader_Installer.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
audioplayers_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
audioplayers_windows_plugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
data/app.so
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
flutter_windows.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
permission_handler_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
permission_handler_windows_plugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
url_launcher_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
url_launcher_windows_plugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
vcruntime140_1.dll
Resource
win11-20260513-en
General
- Target ExLoader_Installer.exe
- Size 161KB
- Sample260530-d7neysfy3m
- SHA256 104f064abd7ea11044c31670b8602b59ef47a78d7c3aa2724c7ea5a0d271f3b9
- MD5 80b250b103b424af5dfc57911d607f61
- SHA1 02a16193f4140d939a74a2d02c28a6f104b6f331
- SHA512 915113ec28586b6ffdc9c757165a2329b1700ada9345f00acd4aeb266db7869a81477d624990e535d242b39b9544baa0dc579501d15c159fdeecba430ded500d
- SSDEEP 3072:DiUtSVi47cMigUaLNQVnolOMeRhe7yzZ0NwUs5:DiUQiIckUaLNQVmO1syz
- TLSH T1E1F38E12B769C499E2B69E78DD2389428931FC425B78D5CFB3902F5E0D396E19E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2580 ExLoader_Installer.exe 2580 ExLoader_Installer.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\weather_now.json
- Size 38KB
- SHA256 5a6eb04b39c2229ab2843adf316bc7f90ac554e15d9f1690f14f72fdf6b70b77
- MD5 6e6c92714198f899135640da0fa24a0a
- SHA1 c70e7512a0d56ef5236367ea9c521b6aeec14cf1
- SHA512 35a47ca892f7a87d4f2b17e8436e5a60fb66eab761eea19847f0a836a8d2910193ce70e1c96652a20d3ca40240028c6c2ac89157fe3f6033ee486324e5717eee
- SSDEEP 768:PCtfpKWNlmii6RwO8rewreqgH5rQZ8r2n:7N
- TLSH T134032620F231CD671119237B28A9306619C58A2F8E843E49778D8D1C9F8DA9F77F9E1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
- Size 144B
- SHA256 863517846cfaa4f0271cfeb4f36a90257a46170fa72c5a82e2bcf67aa738280a
- MD5 72e0d9d4b1f42514523aa20a68b7e283
- SHA1 af9f04ec296466ba5a3451f9e0cbf73d7452599f
- SHA512 8f7e859fcc05bb55804bdd346dbc73886bab93252a806f63d8aae9b29b345450a00d00fdd80e7a29beb82ba035f988b3538515152817461fd35576d5397085a9
- TLSH T159C04CCA9B8401D13ED5CA41157DB4F4D5515A55D48248090829015C875365FEBDFD12
- MD5 SHA1 SHA512 TLSH