Extracted

• • Target

    577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb

  • Size

    773KB

  • MD5

    03de471c92b69d97ceec18cf3c4b5745

  • SHA1

    4e9dc0753d89f8a40f8e2c7734f6389851bec7f6

  • SHA256

    577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb

  • SHA512

    f66f3044c31e0834511dbf04df95835dce8d5562989ec3939c75c9b625af05b8cdbe71f11147a18e72ceec5f8916edd044f91e0c57b06cdf77287f9a7d153dc2

  • SSDEEP

    12288:3zvu+M1iheIgKP429mBbX5TyadWOkhff0rUyOnHl2KzhV+ZtkrbhxM9JbrWBFw2J:e2MldWLhff0aF2AH+cM99riN//

  Score

  10^/10

  xloaderx8bediscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2