Extracted

• • Target
    dcb47525f791f788f7b872f0172da169_JaffaCakes118
  • Size 389KB
  • SHA256 28481e2ae569e56e8fe6929a0c7c59add8850c3b49e8cf6d6873af03b16e884e
  • MD5 dcb47525f791f788f7b872f0172da169
  • SHA1 8489dc409d6262ea0c883245009295fc603defb4
  • SHA512 0267490042e986f25e3d05a8502aae37b2b6f7b1c61685b18f7344250bf4eac430101a7dc93fdf745187c297fe8504f14ada6d7e7453eeed278369ec29c2aa9d
  • SSDEEP 6144:jQYHB9nsq1ugd0nWlpUYUc2CD+Zs23d1A1PGaUZ+x/OzMi4w:R/sqD0nzQD6Zh3dWPri
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderp0onloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2