Extracted

• • Target

    102530f477d4534bc5103e3fb008f00e813bfada11d003d3c71a9c290e7dbf53.exe

  • Size

    464KB

  • MD5

    d6a077bba00394b3817524946a8e7318

  • SHA1

    befd62505b11c5c2213627287b075216aaad132f

  • SHA256

    102530f477d4534bc5103e3fb008f00e813bfada11d003d3c71a9c290e7dbf53

  • SHA512

    9a4e98f140ba42859a41c4cf901ab5e5d0ad9f23a5e3536cb428a6c09c143eae247a3e41be18e0b17e51ca01663712e42d8eba71d1659358ecb82e220a8271d5

  • SSDEEP

    6144:HrO6Uqd2GhN4KjRjaScAkINt1Vmh/4a2c3zBFlBKAHUt43LnWCktAEJ:HPUi2iNTRjaScAknLNn0PJ

  Score

  10^/10

  xloaderb2c0discoveryloaderrat

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2