Extracted

• • Target

    f7ecd12d134aaf3541396c78337ce672

  • Size

    714KB

  • MD5

    f7ecd12d134aaf3541396c78337ce672

  • SHA1

    bb41a84d4f5eef537e41cf4bde375c99bff86a04

  • SHA256

    ec2f5710fdf33c7b843829ebd9f088b15141b643b4354dd92d39b6e290ceca70

  • SHA512

    ef70eb852b370e5f29ca4d27584a3faad34a629c857e135f434b21e483c24fc813fe97fff77eb73dae428fd3e97fb82c3564eae03a18d8bfd0f1a71ba3c9f77a

  Score

  10^/10

  xloadern6g4loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2