Extracted

• • Target

    93fc1e9b8d5d2c69a370b875315b2537406fcd6a86dac8179f20b52eb831fa14

  • Size

    714KB

  • MD5

    22609b8f24553de795041675c857c575

  • SHA1

    9c6696600f3158ec526fcbcda3b5eb9acd5c8453

  • SHA256

    93fc1e9b8d5d2c69a370b875315b2537406fcd6a86dac8179f20b52eb831fa14

  • SHA512

    2337701962dfb08d65263b214dc6ce6a4a897001b3b59a4a0c607c8d7f8201d6bd26dec5dd397e8e621b24c327b903be4afde802c94adbd3445ff2f697e75941

  • SSDEEP

    12288:35VkoEggqlkbCfPaRZAb6QsRUxZhC0HRM5yG1qjyu/9gdz56BJquqc42SiND3zr:kgeCfS46/OZh7xM5yTmk8kBJyr2SYDjr

  Score

  10^/10

  xloaders6apdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2