Extracted

• • Target

    441093812c61d7d3698c2f3288a0b8e24e9082799c078e09b284f2a656a241ae

  • Size

    487KB

  • MD5

    0bbbe187772939439ccbe2c4dcce4021

  • SHA1

    05dae50f46c10370b83f82f5795841d980964bf5

  • SHA256

    441093812c61d7d3698c2f3288a0b8e24e9082799c078e09b284f2a656a241ae

  • SHA512

    ffc89f0e388948cd2564b5ca19c995567c3a73a8ab9feebd9bc7c1f87fd2db5ccaef1316c6e0c6987ab437a5f2061d3c0a3feb1104eca7d8454c8c27d348c7ea

  • SSDEEP

    12288:q8r4IuZ6q4rHmBfZOAZdY7qTBu9xuKVbZ0PgvW/qCj57r8Ehh7IAUP5ViA/if49C:qlKeWgxpi7BVvM0Yqeskkw

  Score

  10^/10

  xloadergab8discoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2