Extracted

Extracted

• • Target

    aoo.exe

  • Size

    984KB

  • MD5

    7900dcea134e84a16491a43722518b95

  • SHA1

    4c904c97c6d806a86edebe06f0972a8f8d20d6d9

  • SHA256

    c349c8a20c6576c397a5dff95fb121e7a16dfdd992e08694a4aacf387cf8c3e7

  • SHA512

    099c086a8451d14df7f2fa9af3a953e5121e45206b8e0f4236414bd774db903763845072f80943fc43f269117a79c0363402114f5412402af74cad3b3ec840fe

  • SSDEEP

    12288:iEx2iNB0O7yJ0JTlkSuiTgcuj0AzWxNAmydE7Cagkjc3p3srKEZGYKxpeQxx+qx8:71+kxkFHbJzuOdEGa3jc3p3Ap8djxU

  Score

  10^/10

  xloadervfm2discoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    vbc.exe

  • Size

    821KB

  • MD5

    d41735b66e58ebee18f4326df912e28b

  • SHA1

    6ee2222ee26abd42c1112841975d2ecc2b09d0c6

  • SHA256

    41fd6b520a4abc453b23329a134e661c39aa19b463dc28bfcbf52bf093661511

  • SHA512

    40d7c1b90d61eecad860d040d03ef7c3a2ec67bd263f2f1d389ade99655dbd5c567983483c48e0b418d9ded7ced1eece6cc26baa75ce43413ebf520ce339dc15

  • SSDEEP

    12288:vFvomht5eIvL6PIJFGMBwbNxZWgT2mn/N4ljTI8Lf8MWakiyfIXy6fsEa:tvvsWweFlBUWg/4lXuFWi6EE

  Score

  10^/10

  xloaderdgrgdiscoveryevasionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4