Extracted

• • Target

    81b66d8cf175ecdcfdbb113d8e020aadef3537b7060ec4f2588cb81724a69e3a

  • Size

    806KB

  • MD5

    deaa34eaf2e31504aebbcc53af44d4b4

  • SHA1

    4f47579328d55a56a8e69906b5deb3c3235865f3

  • SHA256

    81b66d8cf175ecdcfdbb113d8e020aadef3537b7060ec4f2588cb81724a69e3a

  • SHA512

    fc338042c184d05789c5841893c47cf58f4cbf452fd2f649a5e04e7c1dd3cc2c3817940e574b1a09ba2ba5bc56ba27f6756a2f2818273354b61dcabb1f6e0f63

  • SSDEEP

    24576:8INl0VrLH7hR7dVJm3LUYbyBWBAsXfIPJodP3CIzeg:3l0VrDXvGLUMBAsXfIhYP3CB

  Score

  10^/10

  xloaderpdrqdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2