Extracted

• • Target

    d080ca9f39e30376eebb0d8a0c171ef29f24b5d3aa3b7c7f5ff35f6af9d67b1b

  • Size

    877KB

  • MD5

    79a8396afa4bafa7fa10abf4d9742460

  • SHA1

    0b44500dc9152a7fa8a26243e240e63a46097d41

  • SHA256

    d080ca9f39e30376eebb0d8a0c171ef29f24b5d3aa3b7c7f5ff35f6af9d67b1b

  • SHA512

    8b24ff09b77cb0bf7c8cfde7cbcf3c285370e7390452dc2dfeba18d588a93c17ed3196b61e3d9a58bf3fdc4bf136a38910b09af83523ceea0fbf28277e8631c0

  • SSDEEP

    12288:wgEf1smrkBTZsJwO80kgSxeZgitF1McwLVmadIdzZjOUv0wOf3gq8jqGJ5g7d6D3:UzrvJw6k1xIEpRazBd1sjE5g7d0Cq

  Score

  10^/10

  xloadershbcdiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2