Extracted

• • Target

    427b6129f42722d768ebf07bcd966939120313f08e3c5b0c857644f6c2a51693

  • Size

    349KB

  • MD5

    f9bfc7f212a6cd22360e1490f555fbdd

  • SHA1

    24ea648fde606a1ace9716649b9dc2e40ed90b21

  • SHA256

    427b6129f42722d768ebf07bcd966939120313f08e3c5b0c857644f6c2a51693

  • SHA512

    6da89c186e10f47c664a2c633b22deae1dad36a8eaa8b2c3d1d3c882e13d56c79f6f65eb7d2252c2ed37ac081d23008553867f2a3c37cd98a829434d14e1527b

  • SSDEEP

    6144:V4gfheNKl88ef0pNNZ9N2sHjvXIDRqzFQboylBMZ4inoMvXClY:V8Nmqf0ZZPSiEo54ino1C

  Score

  10^/10

  xloaderntfsdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2