Extracted

• • Target

    2acb4f9298ffd24c281b1c897788fba7b6d1d95d8e6e7c7c1ec18aecbda92147

  • Size

    733KB

  • MD5

    dbd7cc7bcce10baf20d105c7d0e8f762

  • SHA1

    79de6f146f60f678db7d07937de42536009b9aa5

  • SHA256

    2acb4f9298ffd24c281b1c897788fba7b6d1d95d8e6e7c7c1ec18aecbda92147

  • SHA512

    b888ac1ff8dd1d7cd542f8c89d5a296090b7ba000d708d6ce26b451269d33f1831c298c105064a11b7fcf4eb8b575a9bda0e4ce304734fc2284d8057a1fc4d42

  • SSDEEP

    12288:rlyru7rbXQvc14U3Ogtu/bcJodeStHugVlNKNQ7idzOVIHmfE6wqe3xYPj0U1:Bya7XX4PU37tu/zeSGjOV9fE6ECPoU

  Score

  10^/10

  xloaderrm3mdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2