Extracted

• • Target
    Invoice.exe
  • Size 840KB
  • SHA256 71da5f67c97d46f0a0a6b6fccb0629690ff520c23e54e6c67b17f35c97cbf09b
  • MD5 ebab60dab6e1229ce726bba5db5f5f27
  • SHA1 0f820f47a6dd6c6950b125f8ac85093b8c7229d7
  • SHA512 bc5ba6bfd594bb683ddd4b5a90f60e197c2f786b8e65775243eca0f18050a7a51d2c58c3a93e69dcca66b92878e4f3a40c87cd68bc196136a1a5574a60497051
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader3e9rloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2