Extracted

• • Target

    881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a

  • Size

    802KB

  • MD5

    66fe9fc4a048631ec4ac9bc4ad55f501

  • SHA1

    302188f68b430e20f0f28d8ec9697a216e341d79

  • SHA256

    881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a

  • SHA512

    71b6fa38cc25d2ceb360b6b6ac6d725cd2137d8e4cd660bd1829997d2223ea9123d247006b3afee96e650b9014871b1d9579d69faa590c6501016a3152243530

  • SSDEEP

    24576:dLa/diQs7a/ichDPvzoKndNQ2dliGBUam:dLlW/Nz/TNqNam

  Score

  10^/10

  xloaderq3c8discoveryevasionexecutionloaderpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2