Extracted

• • Target

    f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118

  • Size

    1.0MB

  • MD5

    f5496358b80bd0a6a027ef71c50babd2

  • SHA1

    576d34b2d11eb03ca3cab8b225a205143047bf8d

  • SHA256

    38ddffbd4400361632904e174fd92126ec7bdac25111851e0439dcddda7f132f

  • SHA512

    c60f138e173f3ce40a6020491bee98429aa8da0d13cafac6153312047816be160a48ec9e309698cc6a369f84bb4a3e6e2468b80d7daf1bd16bda5a1fcb74ccec

  • SSDEEP

    24576:QUPvu9ZO5/d3NaK64fKsE5XyyjKR4nIiypS:QUPvyaaK64A5iyeR4I

  Score

  10^/10

  xloaderdfa8loaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2