Extracted

• • Target
    75d1fd4f92c39987455ea6515a87fdf0
  • Size 1001KB
  • SHA256 ea6c3cc50ca1acd8436ee729f08c344a51b8db314cd72b53462b224d18bee210
  • MD5 75d1fd4f92c39987455ea6515a87fdf0
  • SHA1 4456f5aa05e284fdc305901747c0b39d9a992e02
  • SHA512 429c075f74e946480ce9b6970a58930d408278d57244a9fccf3724cbd92ba11328b69d4e398d45def2a672244fb607cad682bef730c5213b620736b60e1889b1
  • SSDEEP 12288:zkOaIhuSczLS6B+QirANThZp43L3MrN/CPkBqtfM:ztaIETj4ysL3MrN+kQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadernvq4loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2