Extracted

• • Target

    f26c94499e75a2ef55d35ea0a0d2d66f_JaffaCakes118

  • Size

    763KB

  • MD5

    f26c94499e75a2ef55d35ea0a0d2d66f

  • SHA1

    cb863e15848e6665bf6e750de68acd1282e83941

  • SHA256

    090bc9b1aab3f3efacd0afb55b204001290e87aaf9ddd526e298877b0eb6f416

  • SHA512

    cb0060e64076197606b5d70bad4fdc49fcaf731a78e274d03df7e61c01b08b35efcc018e0d18bac31a15b170b3a9b35a5af67a269a21f742fa01534842cc619f

  • SSDEEP

    12288:e5kvqoB4sZ/Bk6Nl0mN/FRk0bKB0XHEmedF6Hv4AnEzcJqLZ5yt:aXoBZZ/Bk6Nl0y/3k0bKB0XH6UHqNk

  Score

  10^/10

  xloadern8baloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2