Extracted

• • Target

    8e71e9516683fb3becd0c6cdf5a9fa64_JaffaCakes118

  • Size

    419KB

  • MD5

    8e71e9516683fb3becd0c6cdf5a9fa64

  • SHA1

    1f4aa8b7878e19c26e11a9001021975f5c2adca0

  • SHA256

    adfc1312ed080bcd3fff720269f3c544b5f33194acb71f36b2393d85eeedc34a

  • SHA512

    fa130c1e05c5a438dc5b8081d409d377298603e95a33f946460fbb3e0c88e824c49b02a06f6f11d19d9736eb6e728f79aa8542f3ef27962d24911c2182c465c8

  • SSDEEP

    12288:AH3sPiRmMzP7J55msJ/yU43aOBxijnKtpqRRrrOXpr:Y31mMRXh/yxqOBkj4qRRr6XJ

  Score

  10^/10

  xloaderur5udiscoveryloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2