Extracted

• • Target
    1f747491324af43e7e9432bf1c805c85_JaffaCakes118
  • Size 382KB
  • SHA256 6623c86614f32885765a529c796fbe3e3b476dc58782a813e622d0d0873eaafb
  • MD5 1f747491324af43e7e9432bf1c805c85
  • SHA1 30af5d5964916a694e52396711be4b2441250e01
  • SHA512 56271611779e2c0f18855deb72b3411a09a8e3e688c143a4eac756f9c88669755c07a6180c1a0d1766203d9bca64bc1b8e660470a5c33ff67f96c3cf4a124133
  • SSDEEP 6144:wqO29cPuZhtAfzC9JZb3xT4A8xBGaF0tDCDdhYwQfDqlxlNCtmSrp:wD29s+71JZbBsAKTF5DdhYwQfDqlxXUv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderb2c0loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2