Extracted

• • Target

    Shipping Documents.exe

  • Size

    691KB

  • MD5

    57b685ccd486b411372b78b6e9705463

  • SHA1

    7e4a97376af2c523b17c6bb5002dd9663cb74ba5

  • SHA256

    4427d66aaf3710031c5545a66e249213b3196045c260bacc730f4298f32b9e39

  • SHA512

    b9e1fd770f4a87f7f7a4d7d7cc9574ab0934f7d0baac9c985a018b9b3a9b28316733eed1e56c8fad6eff78cc6e5c0aa303d05ad1fee9fa7ca8405fbff085fa7e

  • SSDEEP

    12288:aYn11R/5PQ6naUEQOYptwzC3EOO7QcUYfgzqnZuvkjg:nPFV7pgeEOO7Qufg+nZnj

  Score

  10^/10

  xloaderouvkdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2