Extracted

• • Target

    RFQ0473838383.exe

  • Size

    628KB

  • MD5

    315b261c58696e588523ef02adefb688

  • SHA1

    ba05bf49eddd3525b6bdf3b6700716bac07340bf

  • SHA256

    e9a323cf1693e3ade91d24bd4cb4e9f976f905d9fbcd695dc99f6e8005b9680c

  • SHA512

    10cbc5f94941aa5da2d277177176bbdf21b118b77ebb78baf9a9f14859ce5ae7a0bb7560b2c76900723a96c839c72ee937dfe1e7fad6f65bb0b72606c8ffef52

  • SSDEEP

    12288:XODQzJ40CAH7yWEv85imatc0W75RVdtTg3LEFaUuQcbuv/VCk2AlCcasUo:+8Fd7yNDttc0WrlsLicdCv/Vf2HcasU

  Score

  10^/10

  xloaderiaopdiscoveryevasionexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2