Extracted

• • Target

    c7cda00215a9747d2a6142919bd45227_JaffaCakes118

  • Size

    1.4MB

  • MD5

    c7cda00215a9747d2a6142919bd45227

  • SHA1

    5ee0b659b29646b01f40eb89c38f63f96dac9978

  • SHA256

    38b7a5626e00ff148782f6726d11dfabee44922c40bac65a09eaf0b2a44e4c65

  • SHA512

    0a23839e0cec26331e281204b89499fceeed10284cc8913889c9fcaf9109c74ff56405445d63cf4ad29c6b8a94fcb864340146124ceef9f8111f7f1a5d1191d9

  • SSDEEP

    12288:ipKqKvbIzrjF/Tzacdea0At2J6oSYKBgwJYtXt93IiT2fXek/HmUVpX69EV4lm:ipKFjIVzPeaJvZLYtXt95T2fXevO9

  Score

  10^/10

  xloaderi7dgdiscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2