Extracted

• • Target
    SOA.exe
  • Size 581KB
  • SHA256 2d79a5c2368aba8773c00aa3dcfaa0eaf9fe2f80f15bdda080abeb4988940e1b
  • MD5 57ada7e01fedc0c760c11d45827d0efe
  • SHA1 faa4bd3aff6ba8c850bba77043ad5124955a2441
  • SHA512 f57e72ea28a7cc31c4003264735bba0830629c46f0d49095d0a10d06604d12d0134eb45edaabfc6d5ff955c3782a57d1f6936694c963355c96869f15fe1ffcf8
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloader3e9rloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2