Extracted

• • Target

    706f2e7c6cafb3205cff3d498bb5a773_JaffaCakes118

  • Size

    734KB

  • MD5

    706f2e7c6cafb3205cff3d498bb5a773

  • SHA1

    4fe7c2674dbe9106d40c8ab611d5375203fb5fd2

  • SHA256

    fc144e7e5c01d580e1d4ab639b16df8379fcd82ee73c88b9fa0a605f8283e174

  • SHA512

    8ef8e1fb5a43e3a49428bed32336a1afe3440f16dd1971bf68c5086d1276bee0b6156a7e527fa0eebc6ca164784081771750df67817837d5c244ef6c239d73dd

  • SSDEEP

    12288:whx0wWh6FKgqv1JC/GId8spXECbCsSyLQBp5oUF0HK7zNc8JCfMofvTTcFE2zI6t:x4dd8cbfzU1hFJMn8FjfEr5DDwCI1C4z

  Score

  10^/10

  xloadernvq4discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2