Extracted

• • Target
    1cca3910af7cdf03cfb41cdf2ef7fafe_JaffaCakes118
  • Size 669KB
  • SHA256 82ba148765ef811db68c3cbf69b5f46568a49c7f95005883a5d9a3edb3fd18eb
  • MD5 1cca3910af7cdf03cfb41cdf2ef7fafe
  • SHA1 1f48ee6db9425a3ad1a1e317067337db6e3cecd4
  • SHA512 7bde608c61a3907031d173f0b8127232408cb4b3d84dcd256ef079611a06a54f4160e8fd6d23fcb2a3c5e45a08836ba54d6047c8fc8a6ff4463a3db00883f647
  • SSDEEP 12288:ayW/HK7zyrm+lkitcau0M38CUdE8msPO+R0bGsmKkLYOCJ+:7wltct0j328mmSbGslkLYOC0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloadern8badiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2