Overview
overview
3Static
static
3ExLoader_I...er.exe
windows10-2004-x64
1ExLoader_I...er.exe
windows11-ltsc_2024-x64
1audioplaye...in.dll
windows10-2004-x64
1audioplaye...in.dll
windows11-ltsc_2024-x64
1data/app.so
ubuntu-18.04-amd64
1flutter_windows.dll
windows10-2004-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1permission...in.dll
windows10-2004-x64
1permission...in.dll
windows11-ltsc_2024-x64
1url_launch...in.dll
windows10-2004-x64
1url_launch...in.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 04:58
Static task
static1
Behavioral task
behavioral1
Sample
ExLoader_Installer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ExLoader_Installer.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
audioplayers_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
audioplayers_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
data/app.so
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
flutter_windows.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
permission_handler_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
permission_handler_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
url_launcher_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
url_launcher_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260709-en
General
- Target ExLoader_Installer.exe
- Size 173KB
- Sample260723-flwwba1elf
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2572 ExLoader_Installer.exe 2572 ExLoader_Installer.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\weather_now.json
- Size 38KB
- SHA256 e35647808acb0e74ffae4e52b079582029ec05963eb8915555241454d67041c8
- MD5 929215b1ad4ada7d1e6cc9e7793010ec
- SHA1 c82cd0c21358b823b8b816480db642709f0f09fa
- SHA512 224163851fd6a5a93d32efdc8ff8e41db9d8072bfd12e8873898726adcfe081f2e13aa0258a699be5fec591e7df62e5d0996f5487164514872404c986d1d69c6
- SSDEEP 384:LL5+aUjDuxzDiy5IByuCNAWFjqwkxA0TKN6cmP2jSvqdlylNfNJtry:LN0Dux/yX6ZkxvTKNMySvqdcNZry
- TLSH T101034620E231CD67551923BB2869306719C58A2FCE843E49378D8D0C9F8DA5F67FAE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
- Size 104B
- SHA256 e3df728f12e2d53c0e1c0fb017ef35a075cb92dae922f1ebcb9313041a900c03
- MD5 ede593b9e3f3111a6d64dc9723a8ee70
- SHA1 df4ee0817a34294cc5d2180b4fb801c06d621a98
- SHA512 805a0b86e4f9864c7b8692506d2f4af5eaf24b19b806884116be0db0eda331753b50a86bfbd169f87737137269bd222f6711f3bb16891133c06fc2b6bbd2fd4b
- TLSH T119B012A88BC100D03DF4DB04463EB1F441104600C252040B0C3D014CC30270FD3DF916
- MD5 SHA1 SHA512 TLSH