Extracted

• • Target
    Xwbnutju98765456789.exe
  • Size 13KB
  • SHA256 cb50c19d2d18350fed8304ddb50efe3ce6f17d9f5923ffa5d407db718f787c92
  • MD5 00c046f0b491939d5be1d75edc9a0e46
  • SHA1 d3758f72efd4f663c5d8a563a36cc8764ee80d2f
  • SHA512 cd0ce62f3cf9e9b565c4a1a150d7d75e7002acfaf7ed43a476c03a14b1e9432f679b3b2b22b8a97894a0fa1f2df303e3dad9f29a055dbaff8b91422dc3e709d9
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderpot0loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2