Extracted

• • Target

    de4c7e330499031192507c8965381eba4d77fbd82b4e97617d0e57b64fac423e.exe

  • Size

    464KB

  • MD5

    9d8ef908dca972fe7e22dcd40be60030

  • SHA1

    4441cc80934f8a705d9b2254be6b764b8a2979f2

  • SHA256

    de4c7e330499031192507c8965381eba4d77fbd82b4e97617d0e57b64fac423e

  • SHA512

    41cc6d3aa56bb1cce579a57aab04acc604fc2b7e09928d91464670fd7db2e0e0a446b21b4ddea7897afb34d5c61054569c6673b212749c5d11ef8884e674ee8d

  • SSDEEP

    6144:HrO6Uqd2GhN4KjRjaScAkINt1Vmh/4a2c3zBFlBKAHUt43LnWCktAEj:HPUi2iNTRjaScAknLNn0Pj

  Score

  10^/10

  xloaderb2c0discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2