Extracted

• • Target
    8e71e9516683fb3becd0c6cdf5a9fa64_JaffaCakes118
  • Size 419KB
  • SHA256 adfc1312ed080bcd3fff720269f3c544b5f33194acb71f36b2393d85eeedc34a
  • MD5 8e71e9516683fb3becd0c6cdf5a9fa64
  • SHA1 1f4aa8b7878e19c26e11a9001021975f5c2adca0
  • SHA512 fa130c1e05c5a438dc5b8081d409d377298603e95a33f946460fbb3e0c88e824c49b02a06f6f11d19d9736eb6e728f79aa8542f3ef27962d24911c2182c465c8
  • SSDEEP 12288:AH3sPiRmMzP7J55msJ/yU43aOBxijnKtpqRRrrOXpr:Y31mMRXh/yxqOBkj4qRRr6XJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xloaderur5udiscoveryloaderpersistencerat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2