Extracted

• • Target
    SOA.exe
  • Size 44KB
  • SHA256 188e88b01bc05b9e23ce3133471d99ecaec9515404faa787f745fc70bafe4656
  • MD5 cfa809c8fb2550c63f63136893075d04
  • SHA1 963c23acc475923d79ed8a3d17ca183fcfbf084c
  • SHA512 cdcc096ce6d468519081e457c2d1bab85793b0e42036326da73e1d6ad0ac5cd7171410de95cd1b8c63f33180fdc22664d549217c39d00daa61f0ce8ad8cae44f
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderfk84loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2