Extracted

• • Target
    ebcf72ef907fa0a9ffe786476d37cc35
  • Size 506KB
  • SHA256 edadbe7cf0557fdede01500da1d161ceeac3fadd16760f325da7938d25cf2b6e
  • MD5 ebcf72ef907fa0a9ffe786476d37cc35
  • SHA1 004dff609707bc3f3c5775d9ba84b08a68d3ba89
  • SHA512 dd8b491c140158a5d25e070b1305bb679d9181ee918b0bef1cb8e5ce4cf2e22bd1ab5754029c05be0c2f317803b8406af859437eb672174b16c9041190a79a74
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadern6g4loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2