Extracted

• • Target
    8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c
  • Size 498KB
  • SHA256 8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c
  • MD5 9c00fc940483cff2a0f3f619db16ad54
  • SHA1 6f9c746d9cfb4e0bbf829783a82b883f7317b16b
  • SHA512 30451538f9ed65159280a168c711056d7bc0776d0c30f1c82bfa4dfacfe4373c01f503004f1eacc1a690104f99bf7e78c61c5436261c0813508467ff5dd4ff21
  • SSDEEP 12288:SUi2iNa1AvwAZMfTpm6zS0W8Xi0F2bUZYFis:SUi1U/m6zS98SzblV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadergab8discoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2