Extracted

• • Target

    1cca3910af7cdf03cfb41cdf2ef7fafe_JaffaCakes118

  • Size

    669KB

  • MD5

    1cca3910af7cdf03cfb41cdf2ef7fafe

  • SHA1

    1f48ee6db9425a3ad1a1e317067337db6e3cecd4

  • SHA256

    82ba148765ef811db68c3cbf69b5f46568a49c7f95005883a5d9a3edb3fd18eb

  • SHA512

    7bde608c61a3907031d173f0b8127232408cb4b3d84dcd256ef079611a06a54f4160e8fd6d23fcb2a3c5e45a08836ba54d6047c8fc8a6ff4463a3db00883f647

  • SSDEEP

    12288:ayW/HK7zyrm+lkitcau0M38CUdE8msPO+R0bGsmKkLYOCJ+:7wltct0j328mmSbGslkLYOC0

  Score

  10^/10

  xloadern8badiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2