Extracted

• • Target

    f34eea6b9339b34712379c05e1f279bf_JaffaCakes118

  • Size

    484KB

  • MD5

    f34eea6b9339b34712379c05e1f279bf

  • SHA1

    13ff68a530c3147f9208b2297e226047ab8b9c61

  • SHA256

    4505184d5c4f87281fa5ddf2f6581885983b435e56bf7bbbdd6bc97e6accb70d

  • SHA512

    de7ada96b4e30a19d704d6b07a0a2e8ac4e57413dcf48eaa0c02a733fe152a83034b2f605b6a3884fa1f49d8afc42fbdc959f9c7e8800eccc26d830319cde2e4

  • SSDEEP

    12288:GsZNaRYGHi4DGjIH35y6aLqzINZUkrll/q6P27L/gGGWmxiQwnPw6sCyCD6IFBQ:BJL0aFJ1A2TaM+

  Score

  10^/10

  xloadergab8loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2