Extracted

• • Target

    dc8cd94e547cd182eb96ea6d3af0b25bcf11827d6a0f8fcd4d340358e1f9bc77

  • Size

    1.6MB

  • MD5

    ba840e7358bb4e302e1fb21af1e3c77a

  • SHA1

    6d3b9505425e00c404216b853ff6dcea40f286d0

  • SHA256

    dc8cd94e547cd182eb96ea6d3af0b25bcf11827d6a0f8fcd4d340358e1f9bc77

  • SHA512

    0e9b0ca9340d37aed1207cd4f1886584e61a8eee38aeb3c0f4c41d2dc7cf8c5b280d1abfb4086d23441e1a2a33baa80d47b782f2e2cb79026bbd5adeeb3c2c60

  • SSDEEP

    24576:7Bvct+W5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+N:p6iecPBGj2IpqpFNQuiNB/e

  Score

  10^/10

  xloaderc8bsdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2