Extracted

• • Target

    ef69c1b31ab08db5eec628aedd31ffd2_JaffaCakes118

  • Size

    1.1MB

  • MD5

    ef69c1b31ab08db5eec628aedd31ffd2

  • SHA1

    13edc892f792e1460d26dc4fc329d9f6978788ca

  • SHA256

    259e3b91615c56477ea088113187b3d4699ccc3b32b0ae31c5ea49e895d67366

  • SHA512

    2294455861b7850221d1ddf157af40beaf7af6b4a147bdb3beb63498e011441f48ef8aea1fa17baac7141bd292014396a2dffa8fee02db0d636cdd0581d3b8fd

  • SSDEEP

    12288:aPz7sw+52RLlBKxZsOxR0djz0T+LRlEWbKgP7R5kjx3WH4eWNB9D:CYwEYlBKxvxOdjzQm7

  Score

  10^/10

  xloadera0cediscoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2