Extracted

• • Target

    8e6b004fb91c81b531eb93c36fb0544c_JaffaCakes118

  • Size

    454KB

  • MD5

    8e6b004fb91c81b531eb93c36fb0544c

  • SHA1

    ac34c999e62735c6c117507e0fe97dbe0ff30974

  • SHA256

    36dabaa854dac855255b08b096a1fb6cee39f910dfbd2101812a0c5d33b1a983

  • SHA512

    f5c68042a19510f01f67b574d4a0e225e0c7d311571298ecd374f40de2aac6aa95a94a1f32dcc980ed4f1091904747724750d2544b2184451336abbe9a62fb12

  • SSDEEP

    12288:kJCnJC/EMYLysUN8d5k/PrNZIec8NlgTHYDZ0dtN:hc/EMwrd5QPRZLPlgsd

  Score

  10^/10

  xloadermt6ediscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2