Extracted

• • Target

    DOC09178236_20210922.exe

  • Size

    734KB

  • MD5

    38cb740b60d846d2a14a49021a10e164

  • SHA1

    6d1b170fb830773cb750944938f2ada14499fd07

  • SHA256

    d27692420e58cdd646e9a5bd19618387395ee4bc63d10bbe14fe3548e4546889

  • SHA512

    4a4a8f86e7fe559771d401766b4df2f9e194f670222156330f150d72677b92b353d27d8ab43aadd0facae1babc3603bf78bb6e714be559cd9e56294384bbc1ce

  • SSDEEP

    12288:hCmtiK5oKB2GisSjdcBL91Wl2sAzx9u7OSOI5ow5fpvgy2k:M+Fo62oSjd0nJw7OVChvgy2

  Score

  10^/10

  xloaderohi3discoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2