Extracted

• • Target

    ea33022709c503df639489d609127c21_JaffaCakes118

  • Size

    837KB

  • MD5

    ea33022709c503df639489d609127c21

  • SHA1

    accd2282ec0d04f190d2cd9c6e89394379cb7e7d

  • SHA256

    52aaa20eef4d75bb209ef1d632a3e5a894358ebbd5ae9e18262868209fa30b7c

  • SHA512

    520c38e7cd4fa209146961b2ecffe70d8a54227dbe84a8c33a0bb4ae947d5cac22a68ae58f69b37ef75e4b852833e710b6069beade5562272642a1231b3858c4

  • SSDEEP

    12288:CleaXJ+qopzb8WE3vOuq6wiIOFGkFOKicf35Qg6L2/ZsjSmxjnV:7k+GWEGuqykkFvd35Qgf/ZsumV

  Score

  10^/10

  xloaderb6culoaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2