Extracted

• • Target
    8844e06f443a571d2c8f414e56ef37d0.exe
  • Size 1.3MB
  • SHA256 80e474faeb69b9a9081d7f4b6add139d22fb9dcd0aac8bba44dc222d254c8f67
  • MD5 8844e06f443a571d2c8f414e56ef37d0
  • SHA1 ec01ff4c9be3b695098ed20635263a401cefb7fe
  • SHA512 a53f2838ea5312ab74a621972bf495186fede4f661e74cb8a8e798578e2a778345fb381896aeb4a4001610ab468a3880d6f7cf4b1cca9b24da8c58ec126c055c
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderarh2evasionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2