Extracted

• • Target

    13d97308ca4e87d31024b1fcbfca7f7fdac365a4bf2264ca18499847d411bb69

  • Size

    4.4MB

  • MD5

    57c89dd8d8ff1fd5192ce1c48c3acbd6

  • SHA1

    c3a94aedc5fce3afdafe25ac648f3579e71cfaf3

  • SHA256

    13d97308ca4e87d31024b1fcbfca7f7fdac365a4bf2264ca18499847d411bb69

  • SHA512

    bdb1017d539ebdaf39b921ce580d064bd5d148d53def3c0b6879b469e798b212b70e334026c33bf5418afd40a507becb0898df2848b17ec3c961bf2e8bc32479

  • SSDEEP

    98304:l+/nt0ET4PHnq6UYWqq0e/m5Si4/lmBcRC3HnkSR5lxrA7SFqIG:g/Gd/UYIX+5SiWlUL39V67SF

  Score

  10^/10

  xloaderavc9discoveryloaderpersistencepyinstallerrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2