Extracted

• • Target

    7419a11c48f0ed31dc35a63d44f61392_JaffaCakes118

  • Size

    913KB

  • MD5

    7419a11c48f0ed31dc35a63d44f61392

  • SHA1

    be4a8c7b4bd5232bdc4021215dab6140376ca26a

  • SHA256

    ccad88cfcaf9a2b65b29af3fe6b85559efe3ffcf032ada3919cfa656eef60e54

  • SHA512

    8f2e443c8846660f769d8fe5712279b4a0c5267e99df1f195cc6b87508a7dc93177f6965303a7b529068eff22711ce557e3eec62ddb0557eaeda4c5b5f490b3c

  • SSDEEP

    12288:w3LeA2Ei6hYnM2VBnQ1QB7g5r9B0hlskjES3bBzP5mWK1VU68YYi2tHK7zjzKbo0:2Lsyz+qQhgnWTdBzPUWQBp9zKbo0

  Score

  10^/10

  xloaderw56mdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2