Extracted

• • Target

    17a00e54d0b35ab036c2e762106fad08_JaffaCakes118

  • Size

    542KB

  • MD5

    17a00e54d0b35ab036c2e762106fad08

  • SHA1

    4d29e8315b4b7e10373f5a2667165b10d1bbdd39

  • SHA256

    d3287fa834e176bdcc641f75e856ce158b022b0d77776f9fea37ef91b5c442ee

  • SHA512

    8886ddcb1ed598f6f561aba124daf2f6d5846c18f76568962a33cce4fc1063abcb01365f20ceb12398c91435d5d6b895451ef653d7a3f0213e05f6dc85bb3610

  • SSDEEP

    6144:GZ7O/lGq3TYyDeBRNLg7gKKKvJ3k5K71XRcVSy8r2pRHKMqVPDfuPUllmlZ2ZMU:QjYTYyafmcKBvJ3uKxiVHFbHSpDmUll

  Score

  10^/10

  xloaderrihodiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2