Extracted

• • Target

    ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118

  • Size

    1.6MB

  • MD5

    ef3ee1a764a33632b5cf8d0b10853d8d

  • SHA1

    815dde75d76b1f61ac69cff8edfebed265aa801f

  • SHA256

    e91d88bbb3693136fce60e4208200af50f9855a1d4b4e96d164ba7ef8b1e0bda

  • SHA512

    abdda3497ceaba4b2b8513fa5344fc4aa631858c26f9b32fc7f10d0d2971b935859acd27d54845cc4c11a8fc7a920d9d52ac21194ef05e125fdd09cedc8246f0

  • SSDEEP

    24576:nqLS/d3UYdkb7Mb+8w/qx/YNTSlzPdVsC9+8EUUWbmwRGPoN7vdiTbnFM:NM7Mb+8P/xtUeLEcm/PoiM

  Score

  10^/10

  xloaderr58uloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2