Extracted

• • Target

    7ca9a0d88ba188e86459dec2787d2a62_JaffaCakes118

  • Size

    226KB

  • MD5

    7ca9a0d88ba188e86459dec2787d2a62

  • SHA1

    2a2fa39e00a34bba02df935f500174684a26e189

  • SHA256

    86d41e7be9aed92953873e3ac6e2dcd9a624a8a8677409c7cfeb9a5b5f58b499

  • SHA512

    e110b98d1feb4942a3bb42231b8dc8218d55f355db65c8b1ae66928cb246bf9e9545e36c0c5b96bf8e8e51d4d326376a1a0c324e12dd6365801c149818f07602

  • SSDEEP

    6144:OnHtJqpGKzfk32FU+WxTWAxDz9eAfsSebT96h:At0fk3W6iU38AvS6h

  Score

  10^/10

  xloaderu0ufdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2