Extracted

• • Target
    7f6bc5f41f5190704ebfac8d666306ee
  • Size 878KB
  • SHA256 5823174ff78f251ac5b1b8cd1e1727aaa72f8523aa1aace4b59c9ef549d22148
  • MD5 7f6bc5f41f5190704ebfac8d666306ee
  • SHA1 1ae3d6d99ee0462619799dfc722f0bfed442b231
  • SHA512 14c175023c2e961cca96a08b620099dee9d0ce41575bf3a52971f32e5c1bf88fdc362513bee2b165467f1ccf9c44ff31dcd9f50ba72625c53587eb799fa40697
  • SSDEEP 12288:SvcsGI/c4fvh8VtkwODi42tTvwRPdywkYyzXlI8n3dYt2EObbZ:SjHgODjmzVXywtYt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadergm9wloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2