General
- Target ExLoader_Installer.zip
- Size 23.7MB
- Sample260913-ppzaaayxd1
- SHA256 ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d
- MD5 a2a1f6f0c76f692a721292df8e6f779d
- SHA1 d38d053bb541abdc1fbc5531d8c66aeb430b3d32
- SHA512 748ce3e79b7c69b6d04360853739ce47823a0aab221ddff5edad50baaa12d048b3f12395d223b72ba9a95c1a9292d6a713cbff89203c862d8f2bc0ce031b0434
- SSDEEP 393216:kN6+R5xTUGIk2iG0Y9mpiRwWvPUJ2bQ1GEfruhFIpmEsUX35pt8xtyPHjCQo6Cw8:kN7RFIkYmiwWvC20buTmm+Wxy+QumW5n
- TLSH T1D94733C1DB9160A7CD36A7B3857CB0B2D308229F62F35634859CC3606E4BEA8D615FD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ExLoader_Installer.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ExLoader_Installer.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
flutter_windows.dll
Resource
win10v2004-20260911-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target ExLoader_Installer.exe
- Size 173KB
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target flutter_windows.dll
- Size 20.3MB
- SHA256 011e87e890b7bfbac89f63c763341ffb8393d2b4a617dd836c471a0cdaa1346f
- MD5 ae8508a20a3c598ae3668aeb39633755
- SHA1 1052c38074e8836da5becf616cbd147775e9400f
- SHA512 61781fad83efc462ae5dbb616e1b0a2a30e6f35fdb63926913c1c0172f8302f9c39f4e8c2bf1a9a18c0cdab1199eae03c5a4a683248a3e180cce07245643453c
- SSDEEP 98304:FE7hoeyV+kw1ULtPbwDggwZr3hH5epehPTuwTlckSTKZSx8tkvMzVdD+cWUN25el:F3IgBfefQzH7wpuIFybvI9YA4V
- TLSH T132276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47253F66BE01B3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10