Extracted

• • Target
    scan-copy 202204.exe
  • Size 47KB
  • SHA256 e8b9fa0dce20f3c8f27f9b47db399991d6c19be8b50bac6187d06f20cadd1353
  • MD5 ed3fb8f014e6dff481c56d788fe8a628
  • SHA1 044142645e4f23a73fdb7af0897174e78f1cb155
  • SHA512 ad8d3b3af331ca0f9784b95dd05138e044341963925ad0c10601625cb1f312347c8bd44846ee08d61699e157df1ce7ecaebef1dbe0da6779c1b79e9a30ee060a
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaders59hloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2