Overview
overview
7Static
static
3ExLoader_I...er.exe
windows10-2004-x64
7ExLoader_I...er.exe
windows11-ltsc_2024-x64
1audioplaye...in.dll
windows10-2004-x64
1audioplaye...in.dll
windows11-ltsc_2024-x64
1data/app.so
ubuntu-22.04-amd64
1flutter_windows.dll
windows10-2004-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1permission...in.dll
windows10-2004-x64
1permission...in.dll
windows11-ltsc_2024-x64
1url_launch...in.dll
windows10-2004-x64
1url_launch...in.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-uk - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
ExLoader_Installer.exe
Resource
win10v2004-20260513-uk
Behavioral task
behavioral2
Sample
ExLoader_Installer.exe
Resource
win11ltsc2024-20260709-uk
Behavioral task
behavioral3
Sample
audioplayers_windows_plugin.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral4
Sample
audioplayers_windows_plugin.dll
Resource
win11ltsc2024-20260709-uk
Behavioral task
behavioral5
Sample
data/app.so
Resource
ubuntu2204-amd64-20260513-uk
Behavioral task
behavioral6
Sample
flutter_windows.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win11ltsc2024-20260709-uk
Behavioral task
behavioral9
Sample
permission_handler_windows_plugin.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral10
Sample
permission_handler_windows_plugin.dll
Resource
win11ltsc2024-20260709-uk
Behavioral task
behavioral11
Sample
url_launcher_windows_plugin.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral12
Sample
url_launcher_windows_plugin.dll
Resource
win11ltsc2024-20260709-uk
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-uk
Behavioral task
behavioral15
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-uk
Behavioral task
behavioral16
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260709-uk
General
- Target ExLoader_Installer.exe
- Size 173KB
- Sample260905-hyb3sagl21
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4408 ExLoader_Installer.exe 4408 ExLoader_Installer.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\weather_now.json
- Size 38KB
- SHA256 7cc81e1859629221289842c18e6c1af114a5aefffaffdfb3c12ced6a1a2ceb06
- MD5 68d9c1c0900b6288a4d8d2fd388d6b11
- SHA1 5dfbd6d99726d2f7e9e492bc709b9f6a9ff30ad7
- SHA512 db3652bd2dd891c415baf41da5b08bee1c18adc67fdfbaf1bead46005f0995a1ad9c675165efcb0de39a675619bded2093851e2c30a8ee6b257fb9d6ae5323a2
- SSDEEP 384:tpK/UUTazhfMw8JoQej6+jj0Fwyj49+3Sf9xcyjGbO+TJ4/:tA8UTazNf81E6+Hq74MQvcG6OqW/
- TLSH T139034720E231CD67111923BB286930A719C58A2FCE843E49778D8D1C9F8DA5F67F9E1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
- Size 144B
- SHA256 ca44bb7eb67d423093ce4a23bcdaa445477d11b6acf0f28972839d1b4a11d5f0
- MD5 058dfe95090a664848f3e505f5b4aa60
- SHA1 3307224f4cb6444cb8b869b445c7d9871536b620
- SHA512 b6a5932629c69e4a276a6a6595688a528b13e2ba22db426b54d11e496b3cd9d4af52a623103b1db46a368643bac7b42187374dfc2f52195783c07fe03edfff57
- TLSH T1F4C04CCA8B8401D17EA1CA41697EB4F495516915C48308090829015C9B1361FEBDFD22
- MD5 SHA1 SHA512 TLSH