Extracted

• • Target

    6c08713366fe48ccb8ba9cd42f0592aafd343a348d86550ca7c776bb5a5a7565.exe

  • Size

    437KB

  • MD5

    70d090fc55d3b19af4865a0881dd67f2

  • SHA1

    c2bba878e06b81efd6b9294fc92a5a9ee227644b

  • SHA256

    6c08713366fe48ccb8ba9cd42f0592aafd343a348d86550ca7c776bb5a5a7565

  • SHA512

    e3ccdd4dd63f765b65cef898db2a569e62cdcbc218f4ce1464d1578d2bd36494b567bc232f054b1b3cae641b343690d4e5ba26c8d4e0ff7f11bd3b1d2b3270e1

  • SSDEEP

    12288:CUi2iN6U0HWV1HGJIHZTrcXvA7Xxz90aiird:CUi1D0K1mGHZTe2XlOaNrd

  Score

  10^/10

  xloaderp0ondiscoveryexecutionloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2