Extracted

• • Target

    0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118

  • Size

    725KB

  • MD5

    0cfa2a654fcca2a9f12f034d643027d5

  • SHA1

    0c78acaba049a37e7436b0df828057decc6e0378

  • SHA256

    e14a0391577635a7e1121a2ff8c81df2c7d2787015c83839665c469a24f9ce0f

  • SHA512

    6460bb422c3b7b20aef15b4fc1de38c1eabda7db4a9045eb1dca41c4e7bdb56a2c14ef97ce9a75d2829283cffae3c828d59a081a62093ab7de8f1b7a157f40c4

  • SSDEEP

    12288:2VJt2iNeHK7znunNexM5fUql0ZdVvjY+8AMMbb77G9LTUL5yo4XUSD3MvYV8cz1r:2Vz1b7tdTZUMnK/ZPD3aYXz1

  Score

  10^/10

  xloadern8badiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2