Extracted

• • Target
    ebd95b71b4b54bc4c3b43e09447bf288498b33409e26832db137b105527ba6da
  • Size 464KB
  • SHA256 ebd95b71b4b54bc4c3b43e09447bf288498b33409e26832db137b105527ba6da
  • MD5 b1179ef278cde5dd4ce5a2d880688581
  • SHA1 c611c9e61ac32f9255e906492b56f5987e675151
  • SHA512 dbaec6a95935ac8839beeafbc34bf018a5d16ae9385ed72734aafb70cbd2e78d9ecb7a5242ad9aa4655bfa0705d7c5c7308378d630b5631090b9dbf7c35a8b09
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloadertpixevasionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader Payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1