Extracted

• • Target

    b6c03a67716ee57c51bb9b400fe294f2fdc3e996ec1afdeeb820553796c00c31

  • Size

    346KB

  • MD5

    5e14cab7735db2f831e80c7b51254405

  • SHA1

    61957df403a09153c60e1b0789c449fa3786d657

  • SHA256

    b6c03a67716ee57c51bb9b400fe294f2fdc3e996ec1afdeeb820553796c00c31

  • SHA512

    cde0d5e8d673502eb432e4dbc13115be99ad32631b5f6f78517dc176e01e40a0e9f1950d078359a653ce94e3d1feb77990d7ea5fab107298627e29a389253754

  • SSDEEP

    6144:CBFYXmW1WV5kjpzmfxIjdjJ5AuIUvvWkhIFUnLmUjEdPJN6:CsXHEkcGjBXfvvvvYUnNEdPJA

  Score

  10^/10

  xloaderp0ondiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2