Overview
overview
3Static
static
3ExLoader_I...er.exe
windows10-2004-x64
1ExLoader_I...er.exe
windows11-ltsc_2024-x64
1audioplaye...in.dll
windows10-2004-x64
1audioplaye...in.dll
windows11-ltsc_2024-x64
1data/app.so
ubuntu-18.04-amd64
1flutter_windows.dll
windows10-2004-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1permission...in.dll
windows10-2004-x64
1permission...in.dll
windows11-ltsc_2024-x64
1url_launch...in.dll
windows10-2004-x64
1url_launch...in.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
ExLoader_Installer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ExLoader_Installer.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
audioplayers_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
audioplayers_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
data/app.so
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
flutter_windows.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
permission_handler_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
permission_handler_windows_plugin.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
url_launcher_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
url_launcher_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260709-en
General
- Target ExLoader_Installer.exe
- Size 173KB
- Sample260811-ffepvace53
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4612 ExLoader_Installer.exe 4612 ExLoader_Installer.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\weather_now.json
- Size 38KB
- SHA256 2bbbb5cf92a1d6e661b2720ec0683b7abfb148dde3d21cff699f5dcc45b1baae
- MD5 36f7a271a213b5e75d92cab70e7ccd40
- SHA1 d436827ece9c56cfc8fcf83e0d5b508edf2d06f7
- SHA512 d2f628ab2187a5601c5894c21baa6febcc96b8eb51152596e0bbb8e8d9f4566d678a23f1226730e61b015f6c7fd8f3233a58d221a86e96dfddd5825d9ad3f661
- SSDEEP 384:GXvG1rVC6qSSLruSGxgrjP0CrT3nyWyNg6i:G/G9VC6qSSL6SGxgrjPDrT3ryNg6i
- TLSH T1BE033720E231CD67611923BB2869306615858A2FCEC43E4A778DCD0C9F8DA5F67F5E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
- Size 144B
- SHA256 ccaa05006e4f5ec85fd32a32f2d78eb6946d3073a68ea58fe7f7830bb83ebfde
- MD5 e85e3191a4ca028f1a53e3363036bcda
- SHA1 e108c096bf03501816329e7ff41cf144fd4dfefe
- SHA512 6375a5e8b58b4b5e3828d11e156b973a02e96b4974d3758eb7002ac114a2f6e36c6ab91e190a014afdf3bfaf8912d94397713db35a9194e16d7251873ad74b19
- TLSH T105C04CCA8BC401D13D91CA45157EB4F4A6605905D483044A0929459D874361FFBDFD12
- MD5 SHA1 SHA512 TLSH