Extracted

• • Target

    06211dab16dfd4d59a0ff6990a1e4d91_JaffaCakes118

  • Size

    616KB

  • MD5

    06211dab16dfd4d59a0ff6990a1e4d91

  • SHA1

    843eaee36a7838c082722b71fd0718494366923d

  • SHA256

    d082f4efe5f1c11a527ff389705333792fb7f5499f13a236829b3339c6c99f8d

  • SHA512

    10c9901d73432d6dfed1ebec476906e98881bf131bc5fe7a458dcfa7c728810d30155aa0337ad599f58fd5340249acdc4aee01120a3a49cf62d4deadf1950009

  • SSDEEP

    12288:1MDbQ+X8+UiDLbRHahR9bYJPjPyoYA6p2gkSKGBsSNTVHu:EbQ+X8+UiDLbRHahRGrPzYAM79KnSL

  Score

  10^/10

  xloaderu4anloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2