Extracted

• • Target
    427b6129f42722d768ebf07bcd966939120313f08e3c5b0c857644f6c2a51693
  • Size 349KB
  • SHA256 427b6129f42722d768ebf07bcd966939120313f08e3c5b0c857644f6c2a51693
  • MD5 f9bfc7f212a6cd22360e1490f555fbdd
  • SHA1 24ea648fde606a1ace9716649b9dc2e40ed90b21
  • SHA512 6da89c186e10f47c664a2c633b22deae1dad36a8eaa8b2c3d1d3c882e13d56c79f6f65eb7d2252c2ed37ac081d23008553867f2a3c37cd98a829434d14e1527b
  • SSDEEP 6144:V4gfheNKl88ef0pNNZ9N2sHjvXIDRqzFQboylBMZ4inoMvXClY:V8Nmqf0ZZPSiEo54ino1C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderntfsdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2