Extracted

• • Target

    8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c

  • Size

    498KB

  • MD5

    9c00fc940483cff2a0f3f619db16ad54

  • SHA1

    6f9c746d9cfb4e0bbf829783a82b883f7317b16b

  • SHA256

    8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c

  • SHA512

    30451538f9ed65159280a168c711056d7bc0776d0c30f1c82bfa4dfacfe4373c01f503004f1eacc1a690104f99bf7e78c61c5436261c0813508467ff5dd4ff21

  • SSDEEP

    12288:SUi2iNa1AvwAZMfTpm6zS0W8Xi0F2bUZYFis:SUi1U/m6zS98SzblV

  Score

  10^/10

  xloadergab8discoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2