Extracted

• • Target

    f5627afaa1bd709c0472ba296cf90e93f743d58959461eec26ba7b62e7486c70

  • Size

    1.0MB

  • MD5

    9d73b42ce002d0964ac552c4a8be3652

  • SHA1

    86942687836cc75e082399acafefcf17f40c6606

  • SHA256

    f5627afaa1bd709c0472ba296cf90e93f743d58959461eec26ba7b62e7486c70

  • SHA512

    4d768f775e56ca96898657d908c062056f94c69e8765bec277df6c5f9f359446771c17988488836c7e7c281200ced151983e1b690161bd60ff9f2394715889d0

  • SSDEEP

    12288:Wx76RAQOEhGkEHIxZEfzZXbpC+MRxkhxSU739+MAC80dRXXr3SONMTW2KgcYM8+M:YadgVOExA+LQG2CpzXXrNns

  Score

  10^/10

  discoveryxloadernbm3evasionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2