Extracted

• • Target

    5823174ff78f251ac5b1b8cd1e1727aaa72f8523aa1aace4b59c9ef549d22148

  • Size

    878KB

  • MD5

    7f6bc5f41f5190704ebfac8d666306ee

  • SHA1

    1ae3d6d99ee0462619799dfc722f0bfed442b231

  • SHA256

    5823174ff78f251ac5b1b8cd1e1727aaa72f8523aa1aace4b59c9ef549d22148

  • SHA512

    14c175023c2e961cca96a08b620099dee9d0ce41575bf3a52971f32e5c1bf88fdc362513bee2b165467f1ccf9c44ff31dcd9f50ba72625c53587eb799fa40697

  • SSDEEP

    12288:SvcsGI/c4fvh8VtkwODi42tTvwRPdywkYyzXlI8n3dYt2EObbZ:SjHgODjmzVXywtYt

  Score

  10^/10

  xloadergm9wdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2