Extracted

• • Target

    0f3ad8b37553c60914e62e1c274e8e26_JaffaCakes118

  • Size

    1.0MB

  • MD5

    0f3ad8b37553c60914e62e1c274e8e26

  • SHA1

    7954ccb7edaa00714f3f791ba48983bdc8048037

  • SHA256

    7280419b73c5bd75551013c2abe327e15f90cb0f5d4de854bfa7bef5f8f92ad6

  • SHA512

    6a09faeca7bacac60a120e44715300a726a39cb4707bfd14d68cfbd1cc5877407c90a083b94471e90dc203ec6bd3ec2527a1d760b3b937c8f78e79fc14ffad75

  • SSDEEP

    12288:gwumX/w2iNgSFRSCSabatHlWlF2yJyENKus3oYf2xo/mn:vw1WSDDGyJygKusZgoO

  Score

  10^/10

  xloadernvq4discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2