Extracted

• • Target

    Remittance_Advice.exe

  • Size

    379KB

  • MD5

    da19ef06a39a0b1594d3b6239b5ef1ec

  • SHA1

    8fefee7414e25411b6f0fd2eb66c1b7380c83c2a

  • SHA256

    7f9f8cc38a55f713a4d06144cf9e9ebb7967d77aa7ed51aef8aebe70e374c489

  • SHA512

    465f311067c27c87970df0bb5a315f2ae48646578567af10d7622ca756413b9392faa0b47bbfeedc66b9720b84d72b1273914e2a377f02915a7697677189ece8

  • SSDEEP

    6144:MVUNLTYOapBpxKqWDaAE59TfGBw+MeYBVK0ilLlRdLvN34Q8a6:MVUVjapBpFWS9qBw+Mbk0ilLlrFca

  Score

  10^/10

  xloadertk66discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2