Extracted

• • Target

    4b32fb4d21ff7225187b42d4c9722dce_JaffaCakes118

  • Size

    1.1MB

  • MD5

    4b32fb4d21ff7225187b42d4c9722dce

  • SHA1

    331e10b03dc5cf994d3985aea2570f08e2707560

  • SHA256

    5131b99eca49a0694073f43f58543781fd6adecc63a0cd643a50686b4d3e001a

  • SHA512

    d4031c8069d11d78007f215471a982d12ab6059b973477961943dc33d2bf3d0547c95776ebc4b514130964ea9c5e77d2e1b855515c0dea7edf3498e501e2531d

  • SSDEEP

    12288:2Gy2V8gP2iNdmth0+QHU6fm5LJHdkhjn+IZjxwRyCVWHz3T/J4GLIh+wT4P:b1yh0+CcFdyjSkCVm/Jql0

  Score

  10^/10

  xloaderw56mdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2